google-cloud-platform - 使用 "--set-sql-instance"参数部署到云运行时，云构建权限被拒绝

Question

我正在尝试配置构建 的云构建触发器maven springboot 项目，然后部署到云运行。我遇到了一个问题，当我没有指定要连接的云 sql 实例时，它可以工作，但是当我添加 "--set-cloudsql-instances", "${_DATABASE_CONNECTION_NAME}" 时作为参数之一，它会在云构建上引发错误，如下所示:

Step #1: ERROR: (gcloud.beta.run.deploy) PERMISSION_DENIED: The caller does not have permission
Finished Step #1
ERROR
ERROR: build step 1 "gcr.io/cloud-builders/gcloud" failed: exit status 1

以下是我的 cloudbuild.yml

steps:
  - name: 'gcr.io/kaniko-project/executor:latest'
    args:
      - --destination=gcr.io/$PROJECT_ID/${_IMAGE_NAME}
      - --cache=true
  - name: 'gcr.io/cloud-builders/gcloud'
    args: [
      "beta", "run",
      "deploy", "${_SERVICE_NAME}-${_PROFILE}",
      "--image", "gcr.io/${PROJECT_ID}/${_IMAGE_NAME}",
      "--region", "${_REGION}",
      "--platform", "managed",
      "--set-cloudsql-instances", "${_DATABASE_CONNECTION_NAME}",
      "--allow-unauthenticated",
      "--set-env-vars", "SPRING_PROFILES_ACTIVE=${_SPRING_PROFILE},DATABASE_CONNECTION_NAME=${_DATABASE_CONNECTION_NAME},DATABASE_NAME=${_DATABASE_NAME},DATABASE_USERNAME=${_DATABASE_USERNAME},DATABASE_PASSWORD=${_DATABASE_PASSWORD},MINIO_ACCESS_KEY=${_MINIO_ACCESS_KEY},MINIO_SECRET_KEY=${_MINIO_SECRET_KEY},MINIO_HOSTNAME=${_MINIO_HOSTNAME},MINIO_PORT=${_MINIO_PORT}"
    ]
images:
  - gcr.io/${PROJECT_ID}/${_IMAGE_NAME}

我已经为服务帐户设置了角色/权限，如下所示:

{PROJECT_ID}-compute@developer.gserviceaccount.com :编辑器，云 Sql 客户端 <-- 默认 SA

<Cloud run service agent> :Cloud Run 服务代理、Cloud SQL 客户端

<Cloud Build SA> :Cloud Build SA、Cloud Run 管理员

My Cloud Run 服务也使用默认服务帐户作为其 SA

Answer 1

确保您还为 Cloud Build 服务帐户提供了 iam.serviceAccountUser角色，允许它在构建期间模拟 Cloud Run 运行时服务帐号。

gcloud iam service-accounts add-iam-policy-binding
  PROJECT_NUMBER-compute@developer.gserviceaccount.com
  --member="serviceAccount:PROJECT_NUMBER@cloudbuild.gserviceaccount.com"
  --role="roles/iam.serviceAccountUser"

见 Cloud Run deployment permissions了解更多信息。