google-cloud-functions - ERROR : (gcloud. beta.functions.deploy) ... message=[调用者没有权限]

Question

我正在尝试从这个 repo 部署代码:

https://github.com/anishkny/puppeteer-on-cloud-functions

在 Google Cloud Build 中。我的 cloudbuild.yaml 文件内容是:

steps:
- name: 'gcr.io/cloud-builders/gcloud'
  args: ['beta', 'functions', 'deploy', 'screenshot', '--trigger-http', '--runtime', 'nodejs8', '--memory', '1024MB']

我已为我的 Cloud Build 服务帐户 (****@cloudbuild.gserviceaccount.com) 分配了以下角色:

云构建服务帐号

云函数开发人员

然而，在我的 Cloud Build 日志中，我看到以下错误:

starting build "1f04522c-fe60-4a25-a4a8-d70e496e2821"

FETCHSOURCE
Fetching storage object: gs://628906418368.cloudbuild-source.googleusercontent.com/94762cc396ed1bb46e8c5dbfa3fa42550140c2eb-b3cfa476-cb21-45ba-849c-c28423982a0f.tar.gz#1534532794239047
Copying gs://628906418368.cloudbuild-source.googleusercontent.com/94762cc396ed1bb46e8c5dbfa3fa42550140c2eb-b3cfa476-cb21-45ba-849c-c28423982a0f.tar.gz#1534532794239047...
/ [0 files][    0.0 B/  835.0 B]                                                
/ [1 files][  835.0 B/  835.0 B]                                                
Operation completed over 1 objects/835.0 B.                                      
tar: Substituting `.' for empty member name
BUILD
Already have image (with digest): gcr.io/cloud-builders/gcloud
ERROR: (gcloud.beta.functions.deploy) ResponseError: status=[403], code=[Forbidden], message=[The caller does not have permission]
ERROR
ERROR: build step 0 "gcr.io/cloud-builders/gcloud" failed: exit status 1

我错过了什么？

Answer 1

当(可能)Cloud Functions 正式发布时，权限似乎发生了变化。今天另一位客户提出了这个问题，我想起了你的问题。

Cloud Build 机器人 ( ${NUM}@cloudbuild.gserviceaccount.com ) 还需要是 ${PROJECT-ID}@appspot.gserviceaccount.com 的 serviceAccountUser帐户:

备注 Cloud Build 机器人本地部分是项目编号 ( ${NUM} )，appspot 机器人本地部分是项目 ID ( ${PROJECT} )

请尝试:

PROJECT=[[YOUR-PROJECT-ID]]

NUM=$(gcloud projects describe $PROJECT --format='value(projectNumber)')

gcloud iam service-accounts add-iam-policy-binding \
${PROJECT}@appspot.gserviceaccount.com \
--member=serviceAccount:${NUM}@cloudbuild.gserviceaccount.com \
--role=roles/iam.serviceAccountUser \
--project=${PROJECT}

让我知道!