google-cloud-platform - 为什么我看到这个错误 : 'ERROR: (gcloud.run.deploy) PERMISSION_DENIED: The caller does not have permission' while deploying container?

Question

假设我有一个 cloudbuild.yaml文件如下。还假设我可以在使用 gcloud 时手动运行和部署有问题的容器。对于单独的功能(构建和运行)。
部署时，第三步导致报错ERROR: (gcloud.run.deploy) PERMISSION_DENIED: The caller does not have permission

steps:
# Build the container image
- name: 'gcr.io/cloud-builders/docker'
  args: ['build', '-t', 'gcr.io/[PROJECT_ID]/[IMAGE]:$COMMIT_SHA', '.']
# Push the image to Container Registry
- name: 'gcr.io/cloud-builders/docker'
  args: ['push', 'gcr.io/[PROJECT_ID]/[IMAGE]:$COMMIT_SHA']
# Deploy image to Cloud Run
- name: 'gcr.io/cloud-builders/gcloud'
  args:
  - 'run'
  - 'deploy'
  - '[SERVICE_NAME]'
  - '--image'
  - 'gcr.io/[PROJECT_ID]/[IMAGE]:$COMMIT_SHA'
  - '--region'
  - '[REGION]'
  - '--platform'
  - 'managed'
images:
- gcr.io/[PROJECT_ID]/[IMAGE]

Answer 1

请参阅以下文档:
https://cloud.google.com/cloud-build/docs/deploying-builds/deploy-cloud-run#before_you_begin

您需要按照那里提供的步骤操作:

1. Grant the Cloud Run Admin role to the Cloud Build service account:

   • In the Cloud Console, go to the Cloud Build Settings page:

   • Open the Settings page

   • Locate the row with the Cloud Run Admin role and set its Status to ENABLED.

   • In the Additional steps may be required pop-up, click Skip.

2. Grant the IAM Service Account User role to the Cloud Build service account on the Cloud Run runtime service account:

   • In the Cloud Console, go to the Service Accounts page:

   • Open the Service Accounts page

   • In the list of members, locate and select [PROJECT_NUMBER]-compute@developer.gserviceaccount.com. This is theCloud Run runtime service account.

   • Click SHOW INFO PANEL in the top right corner.

   • In the Permissions panel, click the Add Member button.

   • In the New member field, enter the email address of the Cloud Build service account. This is of the form[PROJECT_NUMBER]@cloudbuild.gserviceaccount.com.Note: The email address of Cloud Build service account is different from that of Cloud Run runtime service account.

   • In the Role dropdown, select Service Accounts, and then Service Account User.

   • Click Save.

在我的例子中，@cloudbuild 帐户没有出现在第 2 步的 IAM 建议中，但如果您执行第 1 步并运行您的构建，错误消息将更改为类似于下面已编辑的消息，其中包含您需要的帐户。

ERROR: (gcloud.run.deploy) User [<SOME_NUMBER_HERE>@cloudbuild.gserviceaccount.com] does not have permission to access namespace [<YOUR_PROJECT_ID>] (or it may not exist): Permission 'iam.serviceaccounts.actAs' denied on service account <SOME_OTHER_NUMBER_HERE>-compute@developer.gserviceaccount.com (or it may not exist).