Java中获取应用默认服务账号邮箱及Cloud Tasks认证优化

一、便捷获取当前服务默认服务账号邮箱的方法 #

1. 通过Google Auth库的具体凭据实现类提取 #

GoogleCredentials.getApplicationDefault()返回的抽象类，在Cloud Run环境下实际是ServiceAccountCredentials实例，可强转后直接提取邮箱：

import com.google.auth.oauth2.GoogleCredentials;
import com.google.auth.oauth2.ServiceAccountCredentials;
import com.google.auth.oauth2.ImpersonatedCredentials;

// 获取默认凭据并提取邮箱
GoogleCredentials credentials = GoogleCredentials.getApplicationDefault();
String serviceAccountEmail = null;

// 适配普通服务账号凭据
if (credentials instanceof ServiceAccountCredentials) {
    serviceAccountEmail = ((ServiceAccountCredentials) credentials).getClientEmail();
}
// 适配身份模拟场景的凭据
else if (credentials instanceof ImpersonatedCredentials) {
    serviceAccountEmail = ((ImpersonatedCredentials) credentials).getTargetPrincipal();
}

该方法无需额外配置，直接从默认凭据中提取，完全适配Cloud Run的默认服务账号运行环境。

2. 通过Cloud Run元数据服务器获取 #

在Cloud Run环境中，可直接向元数据服务器发起请求获取当前服务的默认服务账号邮箱：

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

// 从元数据服务器获取服务账号邮箱
HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email"))
        .header("Metadata-Flavor", "Google")
        .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
String serviceAccountEmail = response.body();

注意：本地开发环境无法访问该元数据服务器，需添加环境判断逻辑，仅在Cloud Run部署环境下调用。

二、是否有更优的认证方式？ #

Cloud Tasks调用Cloud Run的认证必须指定服务账号（用于生成合法的OIDC Token），无法完全省略服务账号邮箱配置。但通过上述自动获取邮箱的方法，可避免手动配置环境变量或应用参数，实现“零配置”的认证参数填充。

优化后的任务创建代码示例：

// 自动获取服务账号邮箱
GoogleCredentials credentials = GoogleCredentials.getApplicationDefault();
String requestServiceAccountEmail = ((ServiceAccountCredentials) credentials).getClientEmail();

// 构建定时任务
Task.Builder taskBuilder = Task.newBuilder()
        .setHttpRequest(
                HttpRequest.newBuilder()
                        .setUrl(endpoint)
                        .setHttpMethod(HttpMethod.GET)
                        .setOidcToken(OidcToken.newBuilder()
                                .setServiceAccountEmail(requestServiceAccountEmail)
                                .setAudience(audience).build())
                        .build())
        .setScheduleTime(Timestamp.newBuilder().setSeconds(taskTime.getEpochSecond()));

client.createTask(queuePath, taskBuilder.build());

内容的提问来源于stack exchange，提问作者3urdoch