使用 BigQuery Spark 连接器通过 Datalab 从 Dataproc 连接到 BigQuery 时出错（从元数据服务器获取访问令牌时出错）

我有 BigQuery 表、Dataproc 集群（带有 Datalab），并且遵循本指南：https://cloud.google.com/dataproc/docs/tutorials/bigquery-connector-spark-example https://cloud.google.com/dataproc/docs/tutorials/bigquery-connector-spark-example

bucket = spark._jsc.hadoopConfiguration().get("fs.gs.system.bucket")
project = spark._jsc.hadoopConfiguration().get("fs.gs.project.id")

# Set an input directory for reading data from Bigquery.
todays_date = datetime.strftime(datetime.today(), "%Y-%m-%d-%H-%M-%S")
input_directory = "gs://{}/tmp/bigquery-{}".format(bucket, todays_date)

# Set the configuration for importing data from BigQuery.
# Specifically, make sure to set the project ID and bucket for Cloud Dataproc,
# and the project ID, dataset, and table names for BigQuery.

conf = {
    # Input Parameters
    "mapred.bq.project.id": project,
    "mapred.bq.gcs.bucket": bucket,
    "mapred.bq.temp.gcs.path": input_directory,
    "mapred.bq.input.project.id": project,
    'mapred.bq.input.dataset.id': 'my-test-dataset',
    'mapred.bq.input.table.id': 'test-table'
}

# Read the data from BigQuery into Spark as an RDD.
table_data = spark.sparkContext.newAPIHadoopRDD(
    "com.google.cloud.hadoop.io.bigquery.JsonTextBigQueryInputFormat",
    "org.apache.hadoop.io.LongWritable",
    "com.google.gson.JsonObject",
    conf=conf)

当我尝试连接时该脚本工作正常public数据集。但是，当我尝试连接到我的private数据集，我收到以下错误：

Py4JJavaError: An error occurred while calling z:org.apache.spark.api.python.PythonRDD.newAPIHadoopRDD.
: java.io.IOException: Error getting access token from metadata server at: http://metadata/computeMetadata/v1/instance/service-accounts/default/token
    at com.google.cloud.hadoop.util.CredentialFactory.getCredentialFromMetadataServiceAccount(CredentialFactory.java:210)
    at com.google.cloud.hadoop.util.CredentialConfiguration.getCredential(CredentialConfiguration.java:75)
    at com.google.cloud.hadoop.io.bigquery.BigQueryFactory.createBigQueryCredential(BigQueryFactory.java:82)
    at com.google.cloud.hadoop.io.bigquery.BigQueryFactory.getBigQuery(BigQueryFactory.java:102)
    at com.google.cloud.hadoop.io.bigquery.BigQueryFactory.getBigQueryHelper(BigQueryFactory.java:90)
    at com.google.cloud.hadoop.io.bigquery.AbstractBigQueryInputFormat.getBigQueryHelper(AbstractBigQueryInputFormat.java:357)
    at com.google.cloud.hadoop.io.bigquery.AbstractBigQueryInputFormat.getSplits(AbstractBigQueryInputFormat.java:108)
    at org.apache.spark.rdd.NewHadoopRDD.getPartitions(NewHadoopRDD.scala:125)
    at org.apache.spark.rdd.RDD$$anonfun$partitions$2.apply(RDD.scala:252)
    at org.apache.spark.rdd.RDD$$anonfun$partitions$2.apply(RDD.scala:250)
    at scala.Option.getOrElse(Option.scala:121)
    at org.apache.spark.rdd.RDD.partitions(RDD.scala:250)
    at org.apache.spark.rdd.MapPartitionsRDD.getPartitions(MapPartitionsRDD.scala:35)
    at org.apache.spark.rdd.RDD$$anonfun$partitions$2.apply(RDD.scala:252)
    at org.apache.spark.rdd.RDD$$anonfun$partitions$2.apply(RDD.scala:250)
    at scala.Option.getOrElse(Option.scala:121)
    at org.apache.spark.rdd.RDD.partitions(RDD.scala:250)
    at org.apache.spark.rdd.RDD$$anonfun$take$1.apply(RDD.scala:1333)
    at org.apache.spark.rdd.RDDOperationScope$.withScope(RDDOperationScope.scala:151)
    at org.apache.spark.rdd.RDDOperationScope$.withScope(RDDOperationScope.scala:112)
    at org.apache.spark.rdd.RDD.withScope(RDD.scala:362)
    at org.apache.spark.rdd.RDD.take(RDD.scala:1327)
    at org.apache.spark.api.python.SerDeUtil$.pairRDDToPython(SerDeUtil.scala:203)
    at org.apache.spark.api.python.PythonRDD$.newAPIHadoopRDD(PythonRDD.scala:587)
    at org.apache.spark.api.python.PythonRDD.newAPIHadoopRDD(PythonRDD.scala)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at py4j.reflection.MethodInvoker.invoke(MethodInvoker.java:244)
    at py4j.reflection.ReflectionEngine.invoke(ReflectionEngine.java:357)
    at py4j.Gateway.invoke(Gateway.java:280)
    at py4j.commands.AbstractCommand.invokeMethod(AbstractCommand.java:132)
    at py4j.commands.CallCommand.execute(CallCommand.java:79)
    at py4j.GatewayConnection.run(GatewayConnection.java:214)
    at java.lang.Thread.run(Thread.java:748)
Caused by: java.net.UnknownHostException: metadata
    at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184)
    at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
    at java.net.Socket.connect(Socket.java:589)
    at sun.net.NetworkClient.doConnect(NetworkClient.java:175)
    at sun.net.www.http.HttpClient.openServer(HttpClient.java:463)
    at sun.net.www.http.HttpClient.openServer(HttpClient.java:558)
    at sun.net.www.http.HttpClient.<init>(HttpClient.java:242)
    at sun.net.www.http.HttpClient.New(HttpClient.java:339)
    at sun.net.www.http.HttpClient.New(HttpClient.java:357)
    at sun.net.www.protocol.http.HttpURLConnection.getNewHttpClient(HttpURLConnection.java:1220)
    at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1156)
    at sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1050)
    at sun.net.www.protocol.http.HttpURLConnection.connect(HttpURLConnection.java:984)
    at com.google.api.client.http.javanet.NetHttpRequest.execute(NetHttpRequest.java:93)
    at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:972)
    at com.google.cloud.hadoop.util.CredentialFactory$ComputeCredentialWithRetry.executeRefreshToken(CredentialFactory.java:159)
    at com.google.api.client.auth.oauth2.Credential.refreshToken(Credential.java:489)
    at com.google.cloud.hadoop.util.CredentialFactory.getCredentialFromMetadataServiceAccount(CredentialFactory.java:208)
    ... 35 more

一些附加信息：

1. 我通过 Datalab 使用 python (pySpark)（这是通过https://github.com/GoogleCloudPlatform/dataproc-initialization-actions/tree/master/datalab https://github.com/GoogleCloudPlatform/dataproc-initialization-actions/tree/master/datalab)
2. BigQuery 数据位于美国，Dataproc 集群位于欧盟
3. Dataproc 映像是最新的 (1.2)
4. Dataproc 集群配置为具有 Google 范围内的 API 访问权限

根据您收到的错误消息（Error getting access token from metadata server at: http://metadata/computeMetadata/v1/instance/service-accounts/default/token [...] Caused by: java.net.UnknownHostException: metadata），看起来错误是在服务帐户无法检索访问令牌 https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#applications正确。

为了简化您的用例场景，我建议您首先缩小正在使用的产品范围（因为失败可能发生在不同的步骤中）。为此，我建议您直接从已运行的 Dataproc 集群运行 PySpark 代码，如下所示文档中解释了 https://cloud.google.com/dataproc/docs/tutorials/bigquery-connector-spark-example#reading_and_writing_data_from_bigquery:

1. 转到 GCP Console 中的 Dataproc > 集群菜单。
2. 进入您正在使用的集群，然后进入“VM 实例”选项卡。
3. 单击主节点名称旁边的“SSH”按钮，通过 SSH 连接到主节点。
4. 创建脚本words.py包含您要运行的 PySpark 代码。
5. 使用命令运行脚本spark-submit words.py.

执行此操作后，检查是否收到相同的错误消息。如果这样做，问题应该出在 Dataproc/BigQuery 端。如果不这样做，它很可能位于 Datalab 中。我的猜测是您会收到相同的错误消息，因为它看起来像是凭据问题。

一旦您（可能）确定了问题所在，通过 SSH 连接到集群中的主节点后，通过在终端中运行以下命令来查看您正在使用哪个服务帐户：

gcloud auth list

还要确保环境变量GOOGLE_APPLICATION_CREDENTIALS通过运行以下命令为空。如果为空，则运行该节点的VM实例将使用GCE的默认服务帐户（该帐户应该是您在运行时获得的帐户）gcloud auth list，因为 Dataproc 在 GCE 实例上运行）。如果它不为空，它将使用此环境变量指向的凭据文件。使用默认凭据还是自定义凭据是一种实现选择。

echo $GOOGLE_APPLICATION_CREDENTIALS

一旦您知道正在使用哪个服务帐户，请移至控制台中的 IAM 选项卡，并检查该服务帐户是否具有权限访问 BigQuery 的角色和权限 https://cloud.google.com/bigquery/docs/access-control#predefined_roles_details.

我的猜测是该问题可能与正在使用的服务帐户有关，并且可能GOOGLE_APPLICATION_CREDENTIALS指向错误的位置，因此您应该首先确保您的身份验证配置正确；为此，我将直接从主节点内部运行代码，以简化用例并减少涉及的组件。