切换BigQuery服务账号密钥后出现私钥解析报错，如何排查？

凭据与环境说明 #

我有一份从模板复制的服务账号JSON凭据文件：

{
  "type": "service_account",
  "project_id": "{{ project_id }}",
  "private_key_id": "{{ key.private_key_id }}",
  "private_key": "{{ key.secret }}",
  "client_email": "{{ key.client_email }}",
  "client_id": "{{ key.client_id }}",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "{{ key.cert_url }}"
}

使用只读账号密钥时，该凭据可正常实现BigQuery只读访问，但切换到另一个密钥后，出现如下报错：

Get "https://bigquery.googleapis.com/bigquery/v2/projects/PROJECT1/datasets/DATASET1/tables/TABLE1?alt=json&prettyPrint=false": private key should be a PEM or plain PKCS1 or PKCS8; parse error: asn1: syntax error: sequence truncated

两个JSON文件结构完全一致，仅private_key_id、private_key、client_email、client_id和client_x509_cert_url这几个字段内容不同。报错触发在这段Go代码中：

type EnsureBigQueryTableExistsIn struct {
    DatasetId string
    TableName string
    Reseller  string
}

func EnsureBigQueryTableExists(in EnsureBigQueryTableExistsIn, bqClient *bigquery.Client) error {
    // 检查表是否存在
    ctx := context.Background()
    tableRef := bqClient.Dataset(in.DatasetId).Table(in.TableName)
    if _, err := tableRef.Metadata(ctx); err != nil {
        var e *googleapi.Error
        if errors.As(err, &e) {
            if e.Code != http.StatusNotFound {
                return fmt.Errorf("failed check table existence: %v", err)
            }
            // 表不存在则创建
            err := tableRef.Create(context.Background(), &bigquery.TableMetadata{
                Name: in.TableName,
                Schema: []*bigquery.FieldSchema{
                    {
                        Name: "email",
                        Type: bigquery.StringFieldType,
                    },
                    {
                        Name: "root",
                        Type: bigquery.StringFieldType,
                    },
                    {
                        Name: "sub",
                        Type: bigquery.StringFieldType,
                    },
                    {
                        Name: "ts",
                        Type: bigquery.IntegerFieldType,
                    },
                    {
                        Name: "kind",
                        Type: bigquery.StringFieldType,
                    },
                    {
                        Name: `createdAt`,
                        Type: bigquery.IntegerFieldType,
                    },
                },
            })
            if err != nil {
                return fmt.Errorf("table creation failed: %v", err)
            }
        }
        return fmt.Errorf("failed check table existence: %v", err)
    }
    // 表已存在则跳过创建
    return nil
}

补充：使用只读账号时无上述解析错误，但因权限限制，创建表时会触发如下报错：

table creation failed: googleapi: Error 403: Access Denied: Dataset PROJECT1:DATASET1: Permission bigquery.tables.create denied on dataset PROJECT1:DATASET1 (or it may not exist)., accessDenied)

问题 #

该如何定位问题根源？

内容的提问来源于stack exchange，提问作者Kokizzu