18.2. How RHEL image builder sorts the authentication order of different Google Cloud credentials
You can use several different types of credentials with RHEL image builder to authenticate with GCP. If you set RHEL image builder configuration to authenticate with GCP by using multiple sets of credentials, it uses the credentials in an order of preference.
The order of preference is as follows:
-
Credentials specified with the
image-buildercommand in the configuration file. Application Default Credentialsfrom theGoogle Cloud SDKlibrary, which tries to automatically find a way to authenticate by using the following options:- If the GOOGLE_APPLICATION_CREDENTIALS environment variable is set, Application Default Credentials tries to load and use credentials from the file pointed to by the variable.
Application Default Credentials tries to authenticate by using the service account attached to the resource that is running the code. For example, Google Compute Engine VM.
注意You must use the Google Cloud credentials to determine which Google Cloud project to upload the image to. Therefore, unless you want to upload all of your images to the same Google Cloud project, you always must specify the credentials in the
gcp-config.tomlconfiguration file with theimage-buildercommand.