部署Google Cloud Functions时遇「调用者无权限」403错误

问题描述 #

我通过GitHub Actions使用gcloud命令部署Gen2 Cloud Function，命令如下：

gcloud functions deploy delivery-channels \
          --gen2 \
          --runtime=nodejs20 \
          --region=${{ env.GCP_LOCATION }} \
          --source=workspaces/delivery-channels \
          --trigger-http \
          --entry-point=delivery-channel \
          --allow-unauthenticated

该命令在「development」项目中可正常运行，但在「production」项目执行时失败，报错：

(gcloud.functions.deploy) ResponseError: status=[403], code=[Ok], message=[The caller does not have permission]

已配置的服务账号权限 #

我创建GitHub Actions专用服务账号的步骤如下：

GH_SERVICE_ACCOUNT="serviceAccount:github-actions-${DEPLOYMENT_ENV}@${PROJECT_ID}.iam.gserviceaccount.com"
gcloud iam service-accounts create github-actions-${DEPLOYMENT_ENV} --display-name="GitHub Actions (${DEPLOYMENT_ENV})"
gcloud projects add-iam-policy-binding $PROJECT_ID --member=${GH_SERVICE_ACCOUNT} --role=roles/alloydb.client
gcloud projects add-iam-policy-binding ${PROJECT_ID} --member="${GH_SERVICE_ACCOUNT}" --role='roles/cloudbuild.builds.builder'
gcloud projects add-iam-policy-binding $PROJECT_ID --member=${GH_SERVICE_ACCOUNT} --role=roles/cloudfunctions.admin
gcloud projects add-iam-policy-binding $PROJECT_ID --member=${GH_SERVICE_ACCOUNT} --role=roles/cloudfunctions.developer
gcloud iam service-accounts add-iam-policy-binding \
    ${PROJECT_NUMBER}-compute@developer.gserviceaccount.com \
    --member "${GH_SERVICE_ACCOUNT}" \
    --role roles/iam.serviceAccountUser
gcloud projects add-iam-policy-binding $PROJECT_ID --member=${GH_SERVICE_ACCOUNT} --role=roles/cloudtasks.admin
gcloud projects add-iam-policy-binding $PROJECT_ID --member=${GH_SERVICE_ACCOUNT} --role=roles/container.admin
gcloud projects add-iam-policy-binding $PROJECT_ID --member=${GH_SERVICE_ACCOUNT} --role=roles/container.clusterViewer
gcloud projects add-iam-policy-binding $PROJECT_ID --member=${GH_SERVICE_ACCOUNT} --role=roles/iam.serviceAccountUser
gcloud projects add-iam-policy-binding $PROJECT_ID --member=${GH_SERVICE_ACCOUNT} --role=roles/serviceusage.serviceUsageConsumer
gcloud projects add-iam-policy-binding $PROJECT_ID --member=${GH_SERVICE_ACCOUNT} --role=roles/storage.admin

我认为关键配置是以下两行：

gcloud projects add-iam-policy-binding $PROJECT_ID --member=${GH_SERVICE_ACCOUNT} --role=roles/cloudfunctions.developer
gcloud iam service-accounts add-iam-policy-binding \
    ${PROJECT_NUMBER}-compute@developer.gserviceaccount.com \
    --member "${GH_SERVICE_ACCOUNT}" \
    --role roles/iam.serviceAccountUser

此外，我还尝试给Cloud Build服务账号添加权限：

gcloud projects add-iam-policy-binding $PROJECT_ID --member=serviceAccount:${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com --role=roles/iam.serviceAccountUser

但问题依旧，请问我还遗漏了哪些配置？

解决方案 #

1. 配置Gen2函数默认服务账号的权限 #

Gen2 Cloud Function默认使用${PROJECT_NUMBER}@gcf-admin-robot.iam.gserviceaccount.com作为运行时服务账号，你需要给GitHub Actions使用的服务账号添加对该账号的iam.serviceAccountUser角色，允许它以此身份部署函数：

gcloud iam service-accounts add-iam-policy-binding \
    ${PROJECT_NUMBER}@gcf-admin-robot.iam.gserviceaccount.com \
    --member "${GH_SERVICE_ACCOUNT}" \
    --role roles/iam.serviceAccountUser

2. 验证权限是否生效 #

GCP IAM权限可能存在延迟，部署前可以验证权限是否正确应用：

gcloud projects get-iam-policy $PROJECT_ID --filter="bindings.members:${GH_SERVICE_ACCOUNT}" --format="value(bindings.role)"

确认输出包含roles/cloudfunctions.developer或roles/cloudfunctions.admin。

3. 检查生产项目的API启用状态 #

确保生产项目已启用Cloud Functions API和Cloud Build API：

gcloud services list --enabled --project $PROJECT_ID | grep -E "cloudfunctions|cloudbuild"

如果未启用，执行以下命令开启：

gcloud services enable cloudfunctions.googleapis.com cloudbuild.googleapis.com --project $PROJECT_ID

4. 检查部署时的服务账号指定 #

如果你的部署命令中显式使用了--service-account参数指定了其他运行时账号，需要确保GitHub服务账号拥有对该账号的serviceAccountUser权限。

内容的提问来源于stack exchange，提问作者Fez Vrasta