Cấu hình Vertex AI để gọi Gemini API (keyless và service account)

# === 0. Enable API (tên service KHÔNG đổi dù đã rebrand) ===
gcloud services enable aiplatform.googleapis.com
gcloud services enable storage.googleapis.com   # nếu cần upload file lớn qua GCS

# === 1. Tạo Service Account + gán quyền ===
gcloud iam service-accounts create my-ai-worker --display-name="AI Worker"

gcloud projects add-iam-policy-binding <project-id> \
    --member="serviceAccount:my-ai-worker@<project-id>.iam.gserviceaccount.com" \
    --role="roles/aiplatform.user"
# Nếu dùng GCS: thêm role storage.objectAdmin tương tự

# === 2A. XÁC THỰC KEYLESS (khuyến nghị) - không cần file key ===
gcloud auth application-default login                       # login = danh tính của bạn (máy dev)
gcloud auth application-default set-quota-project <project-id>
# Trên GCE / Cloud Run: gán SA vào máy/service -> ADC tự chạy, không cần lệnh nào

# === 2B. Hoặc dùng JSON key (khi buộc, ví dụ VPS không login được) ===
gcloud iam service-accounts keys create service-account-key.json \
    --iam-account=my-ai-worker@<project-id>.iam.gserviceaccount.com
# LƯU Ý: có thể bị chặn bởi org policy iam.disableServiceAccountKeyCreation -> xem mục Xử lý sự cố

# === 3. Biến môi trường ===
export GOOGLE_CLOUD_PROJECT=<project-id>
export GOOGLE_CLOUD_LOCATION=global    # "global" bắt buộc cho model Gemini 3.x preview
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account-key.json   # CHỈ cần nếu dùng cách 2B

# === 4. Cài SDK (dùng google-genai, KHÔNG dùng vertexai SDK cũ - đã bị gỡ 24/6/2026) ===
pip install "google-genai>=1.51.0" google-auth

# === 5. Test nhanh (keyless - không truyền credentials= -> SDK tự dùng ADC) ===
python3 -c "
from google import genai
client = genai.Client(vertexai=True, project='<project-id>', location='global')
r = client.models.generate_content(model='gemini-2.5-flash', contents='Xin chào')
print(r.text)
"

gcloud services enable aiplatform.googleapis.com

https://console.cloud.google.com/apis/library/aiplatform.googleapis.com?project=<project-id>

gcloud services enable storage.googleapis.com

gcloud iam service-accounts create my-ai-worker --display-name="AI Worker"

gcloud projects add-iam-policy-binding <project-id> \
    --member="serviceAccount:my-ai-worker@<project-id>.iam.gserviceaccount.com" \
    --role="roles/aiplatform.user"

gcloud auth application-default login
gcloud auth application-default set-quota-project <project-id>

gcloud auth application-default login \
    --impersonate-service-account=my-ai-worker@<project-id>.iam.gserviceaccount.com

gcloud iam service-accounts keys create service-account-key.json \
    --iam-account=my-ai-worker@<project-id>.iam.gserviceaccount.com

scp service-account-key.json <username>@<server-ip>:/path/to/project/service-account-key.json
ssh <username>@<server-ip> "chmod 600 /path/to/project/service-account-key.json"

echo "service-account-key.json" >> .gitignore
# Kiểm tra đã ignore chưa:
git check-ignore service-account-key.json

# === VERTEX AI CONFIG ===
GOOGLE_CLOUD_PROJECT=<project-id>
GOOGLE_CLOUD_LOCATION=global
# Chỉ cần dòng dưới nếu dùng JSON key (cách D); Keyless thì BỎ dòng này:
GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account-key.json

# Model
GEMINI_MODEL=gemini-2.5-flash

pip install "google-genai>=1.51.0" google-auth
# google-cloud-storage nếu upload file lên GCS

import os
from dotenv import load_dotenv
from google import genai
from google.genai import types

load_dotenv()

# Không truyền credentials= -> SDK tự dùng Application Default Credentials (ADC)
# (từ 'gcloud auth application-default login', attached SA, hoặc impersonation)
client = genai.Client(
    vertexai=True,
    project=os.getenv('GOOGLE_CLOUD_PROJECT'),
    location=os.getenv('GOOGLE_CLOUD_LOCATION', 'global'),
)

response = client.models.generate_content(
    model=os.getenv('GEMINI_MODEL', 'gemini-2.5-flash'),
    contents='Xin chào, hãy giới thiệu bạn là ai?',
    config=types.GenerateContentConfig(max_output_tokens=1024, temperature=0.7),
)
print(response.text)

import os
from dotenv import load_dotenv
from google import genai
from google.oauth2 import service_account

load_dotenv()

creds = service_account.Credentials.from_service_account_file(
    os.getenv('GOOGLE_APPLICATION_CREDENTIALS'),
    scopes=['https://www.googleapis.com/auth/cloud-platform'],
)

client = genai.Client(
    vertexai=True,
    project=os.getenv('GOOGLE_CLOUD_PROJECT'),
    location=os.getenv('GOOGLE_CLOUD_LOCATION', 'global'),
    credentials=creds,
)
# ... gọi generate_content như trên

ACCESS_TOKEN=$(gcloud auth print-access-token)

curl -X POST \
  "https://aiplatform.googleapis.com/v1/projects/<project-id>/locations/global/publishers/google/models/gemini-2.5-flash:generateContent" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "contents": [{"role": "user", "parts": [{"text": "Xin chào"}]}]
  }'

An Organization Policy that blocks service accounts key creation has been enforced
on your organization.  (iam.disableServiceAccountKeyCreation)

{ "error": { "code": 404,
  "message": "Publisher Model `.../locations/us-central1/publishers/google/models/gemini-3.1-pro-preview` was not found",
  "status": "NOT_FOUND" } }

# SAI - regional không có model 3.x preview
client = genai.Client(vertexai=True, project='<project-id>', location='us-central1')
# ĐÚNG
client = genai.Client(vertexai=True, project='<project-id>', location='global')

import os
from dotenv import load_dotenv
from google import genai
from google.genai import types

load_dotenv()

# Keyless: không truyền credentials=. Dùng global để test cả model 3.x preview.
client = genai.Client(
    vertexai=True,
    project=os.getenv('GOOGLE_CLOUD_PROJECT'),
    location='global',
)

models_to_test = [
    'gemini-2.5-flash',
    'gemini-2.5-pro',
    'gemini-2.5-flash-lite',
    'gemini-3-flash-preview',
    'gemini-3.1-pro-preview',
]

for m in models_to_test:
    try:
        client.models.generate_content(
            model=m, contents='Xin chào',
            config=types.GenerateContentConfig(max_output_tokens=20),
        )
        print(f'[OK]   {m}')
    except Exception as e:
        print(f'[FAIL] {m}: {str(e)[:80]}')