获取 java.io.IOException：获取服务帐户的访问令牌时出错：调用数据存储时连接超时

Posted 2023-03-29

【中文标题】获取 java.io.IOException：获取服务帐户的访问令牌时出错：调用数据存储时连接超时

【英文标题】：Getting java.io.IOException: Error getting access token for service account: connect timed out while making a call to datastore

【发布时间】：2021-10-14 01:58:33

【问题描述】：

我的应用程序在本地运行良好，并且能够从本地连接到 GCP 数据存储区。但是当部署到服务器时，我得到了以下异常。

Caused by: com.google.datastore.v1.client.DatastoreException: I/O error\n\t
at com.google.datastore.v1.client.RemoteRpc.makeException(RemoteRpc.java:136)\n\t
at com.google.datastore.v1.client.RemoteRpc.call(RemoteRpc.java:105)\n\t
at com.google.datastore.v1.client.Datastore.beginTransaction(Datastore.java:79)\n\t
at com.google.cloud.datastore.spi.v1.HttpDatastoreRpc.beginTransaction(HttpDatastoreRpc.java:153)\n\t... 92 common frames omitted\nCaused by: java.io.IOException: Error getting access token for service account: connect timed out\n\t
at com.google.auth.oauth2.ServiceAccountCredentials.refreshAccessToken(ServiceAccountCredentials.java:444)\n\t
at com.google.auth.oauth2.OAuth2Credentials.refresh(OAuth2Credentials.java:157)\n\t
at com.google.auth.oauth2.OAuth2Credentials.getRequestMetadata(OAuth2Credentials.java:145)\n\t
at com.google.auth.oauth2.ServiceAccountCredentials.getRequestMetadata(ServiceAccountCredentials.java:603)\n\t
at com.google.auth.http.HttpCredentialsAdapter.initialize(HttpCredentialsAdapter.java:91)\n\t
at com.google.cloud.http.HttpTransportOptions$1.initialize(HttpTransportOptions.java:159)\n\t
at com.google.cloud.http.CensusHttpModule$CensusHttpRequestInitializer.initialize(CensusHttpModule.java:109)\n\t
at com.google.cloud.datastore.spi.v1.HttpDatastoreRpc$1.initialize(HttpDatastoreRpc.java:91)\n\t
at com.google.datastore.v1.client.RemoteRpc.call(RemoteRpc.java:91)\n\t... 94 common frames omitted\nCaused by: java.net.SocketTimeoutException: connect timed out\n\t
at java.base/java.net.PlainSocketImpl.socketConnect(Native Method)\n\t
at java.base/java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:399)\n\t
at java.base/java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:242)\n\t
at java.base/java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:224)\n\t
at java.base/java.net.SocksSocketImpl.connect(SocksSocketImpl.java:403)\n\t
at java.base/java.net.Socket.connect(Socket.java:591)\n\t
at java.base/sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:285)\n\t
at java.base/sun.net.NetworkClient.doConnect(NetworkClient.java:177)\n\t
at java.base/sun.net.www.http.HttpClient.openServer(HttpClient.java:474)\n\t
at java.base/sun.net.www.http.HttpClient.openServer(HttpClient.java:569)\n\t
at java.base/sun.net.www.protocol.https.HttpsClient.<init>(HttpsClient.java:265)\n\t
at java.base/sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:372)\n\t
at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)\n\t
at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1181)\n\t
at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1075)\n\t
at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)\n\t
at java.base/sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1356)\n\t
at java.base/sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1331)\n\t
at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:241)\n\t
at com.google.api.client.http.javanet.NetHttpRequest.execute(NetHttpRequest.java:113)\n\t
at com.google.api.client.http.javanet.NetHttpRequest.execute(NetHttpRequest.java:84)\n\t
at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1012)\n\t
at com.google.auth.oauth2.ServiceAccountCredentials.refreshAccessToken(ServiceAccountCredentials.java:441) 

编辑 - 此凭据下的范围

[https://www.googleapis.com/auth/pubsub,
 https://www.googleapis.com/auth/spanner.admin,
 https://www.googleapis.com/auth/spanner.data, 
https://www.googleapis.com/auth/datastore, 
https://www.googleapis.com/auth/sqlservice.admin, 
https://www.googleapis.com/auth/devstorage.read_only, 
https://www.googleapis.com/auth/devstorage.read_write, 
https://www.googleapis.com/auth/cloudruntimeconfig, 
https://www.googleapis.com/auth/trace.append, 
https://www.googleapis.com/auth/cloud-platform, 
https://www.googleapis.com/auth/cloud-vision, 
https://www.googleapis.com/auth/bigquery, 
https://www.googleapis.com/auth/monitoring.write]

任何线索将不胜感激。 提前谢谢！

【问题讨论】：

看看这对你有没有帮助github.com/googleapis/google-cloud-datastore/issues/86

@SusanMustafa 感谢苏珊的快速回复。在发布问题之前，我确实看过那篇文章。这没有帮助。

想知道您是否真的对其进行了身份验证？ gcloud auth application-default login

部署到什么服务器？该服务器是如何配置网络的？如果是 Compute Engine，哪些范围分配给默认服务帐号？

将您的评论内容放在您的问题中，而不是作为评论（太难阅读）。

【参考方案1】：

原来是连接问题。我们的服务器（在 AWS 中）无权访问数据存储区。

【讨论】：

您的帖子不是回答，而是澄清您的问题。您为解决访问数据存储的权利做了哪些更改？