配置constraints/cloudbuild.allowedWorkerPools后App Engine部署失败求助

组织策略与项目例外规则 #

所在组织配置了Org Policy constraints/cloudbuild.allowedWorkerPools，并为项目forreal添加了带条件的例外规则，规则详情：

Rule 3
Allowed: under:projects/forreal
Condition: 
  Title :test
  Expression : 
    resource.matchTag("315235378160/locations", "us-central1") || resource.matchTagId("tagKeys/281481244491293", "tagValues/281482598826314")

部署报错详情 #

执行gcloud app deploy部署App Engine服务时失败，报错信息如下：

$ gcloud app deploy
Services to deploy:

descriptor:                  [/home/marcelo/appengine/app.yaml]
source:                      [/home/marcelo/appengine]
target project:              [forreal]
target service:              [martest]
target version:              [20240104t212113]
target url:                  [https://martest-dot-forreal.uc.r.appspot.com]
target service account:      [forreal@appspot.gserviceaccount.com]


Do you want to continue (Y/n)?  

Beginning deployment of service [martest]...
Created .gcloudignore file. See `gcloud topic gcloudignore` for details.
Uploading 3 files to Google Cloud Storage
33%
67%
100%
100%
File upload done.
WARNING: Node.js 16 is no longer supported by the Node.js community as of 11 September, 2023. Node.js 16 will be end of support on 2024-01-30. As of 2024-01-30 you will no longer be able to deploy your App Engine Standard using nodejs16. We recommend you to upgrade to the latest version of Node.js as soon as possible.

Updating service [martest]...failed.                                                                                                                                                                                                            
ERROR: (gcloud.app.deploy) Error Response: [13] Failed to create cloud build: Constraint "constraints/cloudbuild.allowedWorkerPools" violated for "projects/forreal" attempting to create a Build with WorkerPool option "". For more information, see https://cloud.google.com/build/docs/private-pools/using-vpc-service-controls#setting_up_organization_policy_constraints. You must specify a WorkerPool option for this Build.
com.google.net.rpc3.client.RpcClientException: <eye3 title='/ArgoAdminNoCloudAudit.CreateBuild, FAILED_PRECONDITION'/> APPLICATION_ERROR;google.devtools.cloudbuild.v1/ArgoAdminNoCloudAudit.CreateBuild;Constraint "constraints/cloudbuild.allowedWorkerPools" violated for "projects/forreal" attempting to create a Build with WorkerPool option "". For more information, see https://cloud.google.com/build/docs/private-pools/using-vpc-service-controls#setting_up_organization_policy_constraints. 
You must specify a WorkerPool option for this Build.;AppErrorCode=9;StartTimeMs=1704403280806;unknown;ResFormat=uncompressed;ServerTimeSec=2.447271665;LogBytes=256;Non-FailFast;EndUserCredsRequested;EffSecLevel=none;ReqFormat=uncompressed;ReqID=a0fd228d6ed45330;GlobalID=0;Server=[2002:a05:6671:39d4:b0:96b:ccea:f0]:4001.

求助问题 #

已为项目配置例外规则，但部署仍触发约束报错，怀疑App Engine是否兼容该组织策略，求解决部署失败的方法。

内容的提问来源于stack exchange，提问作者miturbe