Reduced OAuth scope to read_write

docs/sources/installation/configuration.md

@@ -683,6 +683,8 @@ basic auth password
 Path to JSON key file associated with a Google service account to authenticate and authorize.
 Service Account keys can be created and downloaded from https://console.developers.google.com/permissions/serviceaccounts.
 
+Service Account should have "Storage Object Writer" role.
+
 ### bucket name
 Bucket Name on Google Cloud Storage. 
 

pkg/components/imguploader/gcsuploader.go

@@ -39,7 +39,7 @@ func (u *GCSUploader) Upload(imageDiskPath string) (string, error) {
 
 	log.Debug("Creating JWT conf")
 
-	conf, err := google.JWTConfigFromJSON(data, "https://www.googleapis.com/auth/devstorage.full_control")
+	conf, err := google.JWTConfigFromJSON(data, "https://www.googleapis.com/auth/devstorage.read_write")
 	if err != nil {
 		return "", err
 	}