direnvを使ってGoogle Cloudプロジェクトの認証情報を簡単に切り替えてみる

$ gcloud auth  list
          Credentialed Accounts
ACTIVE  ACCOUNT
*       kobayashi-1@example.com
        kobayashi-2@example.com

$ gcloud config configurations list
NAME                     IS_ACTIVE  ACCOUNT                            PROJECT                  COMPUTE_DEFAULT_ZONE  COMPUTE_DEFAULT_REGION
project_a             True      kobayashi-1@example.com  example-project-a             asia-northeast1-a     asia-northeast1
project_b             False      kobayashi-1@example.com  example-project-b             asia-northeast1-a     asia-northeast1
project_c             False      kobayashi-2@example.com  example-project-c             asia-northeast1-a     asia-northeast1

.
├── project_a
│   ├── .envrc
│   └── gcs_list.py
├── project_b
│   ├── .envrc
│   └── gcs_list.py
└── project_c
    ├── .envrc
    └── gcs_list.py

import jwt
from google.cloud import storage
import google.auth
import google.auth.transport.requests
from google.oauth2.credentials import Credentials
from google.auth.exceptions import DefaultCredentialsError

def print_buckets():
    client = storage.Client()
    print("Bucket情報:")
    for bucket in client.list_buckets():
        print(bucket.name)

def print_default_credentials_info():
    credentials, project = google.auth.default()

    request = google.auth.transport.requests.Request()
    credentials.refresh(request)

    # IDトークンからメールアドレスを抽出
    decoded = jwt.decode(credentials.id_token, options={"verify_signature": False})
    email = decoded.get('email')
    print("ADC情報:")
    print(f"プロジェクトID: {project}")
    print(f"アカウント: {email}")

# メイン処理
if __name__ == "__main__":
    print_buckets()
    print_default_credentials_info()

export CLOUDSDK_ACTIVE_CONFIG_NAME={gcloud config configurations listのNAME}

$ cd project_a
direnv: loading ~/project_a/.envrc
direnv: export +CLOUDSDK_ACTIVE_CONFIG_NAME

$ gcloud storage ls
gs://kobayashi-project-a/

$ gcloud config  list
[compute]
region = asia-northeast1
zone = asia-northeast1-a
[core]
account = kobayashi-1@example.com
disable_usage_reporting = True
project = example-project-a

Your active configuration is: [project_a]

$ cd project_b
direnv: loading ~/project_b/.envrc
direnv: export +CLOUDSDK_ACTIVE_CONFIG_NAME

$ gcloud storage ls
gs://kobayashi-project-b/

$ cd project_c
direnv: loading ~/project_c/.envrc
direnv: export +CLOUDSDK_ACTIVE_CONFIG_NAME

$ gcloud storage ls
gs://kobayashi-project-c/

export CLOUDSDK_ACTIVE_CONFIG_NAME={gcloud config configurations listのNAME}

# 以下追加
confirm_adc() {
	local adc_file="$HOME/.config/gcloud/application_default_credentials.json"
	local client_id=$(jq -r .client_id "$adc_file")
	local client_secret=$(jq -r .client_secret "$adc_file")
	local refresh_token=$(jq -r .refresh_token "$adc_file")

    local token_response=$(curl -s -d "client_id=$client_id&client_secret=$client_secret&refresh_token=$refresh_token&grant_type=refresh_token" \
                            https://oauth2.googleapis.com/token)

    local decode_token=$(echo $token_response | jq -r .id_token | cut -d"." -f2 | base64 -d)

    local gcloud_email=$(gcloud config get-value account --quiet 2>/dev/null)

    if [[ ! $decode_token == *"$gcloud_email"* ]]; then
    	echo "adcとgcloud configのアカウントが異なるのでadcの再設定をします"
    	gcloud auth application-default login
	fi
}

confirm_adc

project_id=$(gcloud config get-value project --quiet 2>/dev/null)
email=$(gcloud config get-value account --quiet 2>/dev/null)

echo "Project ID: $project_id"	
echo "Accounts Email: $email"	

$ cd project_a
direnv: loading ~/project_a/.envrc
adcとgcloud configのアカウントが異なるのでadcの再設定をします。
Your browser has been opened to visit:

    https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=......

....

Project ID: example-project-a
Accounts Email: kobayashi-1@example.com
direnv: export +CLOUDSDK_ACTIVE_CONFIG_NAME

$ python google_resources.py
Bucket情報:
kobayashi-project-a
ADC情報:
プロジェクトID: example-project-a
アカウント: kobayashi-1@example.com

$ cd ../project_b
direnv: loading ~/project_b/.envrc
Project ID: example-project-b
Accounts Email: kobayashi-1@example.com
direnv: export +CLOUDSDK_ACTIVE_CONFIG_NAME

$ python google_resources.py
Bucket情報:
kobayashi-project-b
ADC情報:
プロジェクトID: example-project-b
アカウント: kobayashi-1@example.com

$ cd ../project_c
direnv: loading ~/project_c/.envrc
adcとgcloud configのアカウントが異なるのでadcの再設定をします。
Your browser has been opened to visit:

    https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=......

....

Project ID: example-project-c
Accounts Email: kobayashi-2@example.com
direnv: export +CLOUDSDK_ACTIVE_CONFIG_NAME

$ python google_resources.py
Bucket情報:
kobayashi-project-c
ADC情報:
プロジェクトID: example-project-c
アカウント: kobayashi-2@example.com