8000 fix(openclaw): use ADC instead of service account keys (#207) by Sabina8205 · Pull Request #220 · google/skills · GitHub
[go: up one dir, main page]
Skip to content

Repository navigation

fix(openclaw): use ADC instead of service account keys (#207) #220

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Sabina8205 wants to merge 1 commit into from
Closed

fix(openclaw): use ADC instead of service account keys (#207) #220

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 12 additions & 31 deletions skills/cloud/agent-platform-migrate-from-ai-studio/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -253,39 +253,21 @@ these steps.
Account) has the `aiplatform.user` IAM role - see Authentication and
Authorization section above.

3. Get the project number from the user's project ID. Outside of GCE, run:
3. Authenticate using Application Default Credentials (ADC) appropriate for
the runtime:

```bash
export PROJECT_NUMBER=$(gcloud projects describe "$PROJECT_ID" --format="value(projectNumber)")
echo "Project number: $PROJECT_NUMBER"

```

Within a Compute Engine VM, run:

```bash
export PROJECT_NUMBER=$(curl "http://metadata.google.internal/computeMetadata/v1/project/project-id" -H "Metadata-Flavor: Google")
echo "Project number: $PROJECT_NUMBER"
```

4. From outside the GCE instance, generate `GOOGLE_APPLICATION_CREDENTIALS`
using the Google Cloud project number. Then, `scp` these credentials to the
GCE VM.

```bash
mkdir -p ~/.config/gcloud
gcloud iam service-accounts keys create ~/.config/gcloud/application_default_credentials.json --iam-account="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"
```
* On a Compute Engine VM, ADC automatically uses the VM's attached Service
Account. Do not create, copy, or configure a Service Account key file.
* On a workstation, authenticate with your user identity:

> ⚠️ **Troubleshooting Policy Constraints on New Orgs**: New Google
> Cloud organizations (created on or after May 4th, 2024) enforce a [legacy Organization Policy, restricting Service Account Key Creation](https://docs.cloud.google.com/organization-policy/restrict-service-accounts.md.txt). To complete this step, this Org Policy must be temporarily disabled.
> An Organization Policy Admin must set this policy to Inactive.
> To the agent: Check if this policy is enforced, and if it is: pause, and
> prompt the user to disable it at this Console link:
> https://console.cloud.google.com/iam-admin/orgpolicies
```bash
gcloud auth application-default login
```

* On a non-Google-Cloud host, use [Workload Identity Federation](https://docs.cloud.google.com/iam/docs/workload-identity-federation)
rather than a downloaded Service Account key.

5. Edit the configuration file that's usually located at:
4. Edit the configuration file that's usually located at:
`~/.openclaw/openclaw.json`. Ensure you prefix the Gemini model with
`google-vertex/`.

Expand All @@ -300,8 +282,7 @@ gcloud iam service-accounts keys create ~/.config/gcloud/application_default_cre
"env": {
"vars": {
"GOOGLE_CLOUD_PROJECT": "PROJECT_ID",
"GOOGLE_CLOUD_LOCATION": "global",
"GOOGLE_APPLICATION_CREDENTIALS": "~/.config/gcloud/application_default_credentials.json"
"GOOGLE_CLOUD_LOCATION": "global"
}
},
"agents": {
Expand Down
0