Scopes of access_tokens are not quite the same as GCE about gce_metadata_server HOT 4 CLOSED

OK interesting. I am using Cloud Run which must be setup differently to GCE VMs (but it still has a local metadata sidecar). Yeah I found the flag override and everything is working with that.

Thanks for the emulator its great for testing.

from gce_metadata_server.

I see you have jus the email scope set. I am pretty sure the default behavior of metadata server includes https://www.googleapis.com/auth/cloud-platform

from gce_metadata_server.

The named default scopes (atleast generated by the cli) include a couple of others but not cloud-platform itself:
https://cloud.google.com/sdk/gcloud/reference/alpha/compute/instances/set-scopes

you get cloud-platform if you enable (on the ui) all apis.

I kept the minimal scopes here just to fulfill the /identity endpoint capabilities.

You could override the scopes w/ the flag which bootstraps the default credentials:

https://github.com/salrashid123/gce_metadata_server/blob/master/main.go#L404

from gce_metadata_server.

glad its helpful!. FWIW, the metadata servers between GCE and Run are slightly different. eg, in Cloud Run you can even specify non-Cloud API scopes:

• https://cloud.google.com/run/docs/securing/service-identity#access_tokens

curl "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token?scopes=[SCOPES]"  -H "Metadata-Flavor: Google"

( i suppose i can add that into this metadata server implementation too)

from gce_metadata_server.