Python Google Cloud Function构建失败（状态码51）求助

问题概述 #

与Stack Overflow上某Node.js问题类似，我的Python Cloud Functions出现随机触发的状态码51构建失败。相同的Terraform配置在同网络/无服务器连接器的另一个项目中可正常运行，当前部署环境为us-east4区域，使用企业代理，仅部署简单Hello World脚本。

错误信息 #

"ERROR: build step 1 "us-east4-docker.pkg.dev/gae-runtimes/gcp/buildpacks/google-gae-22/python/builder:python_20230807_RC00" failed: step exited with non-zero status: 51"

Cloud Function日志 #

│ Error: Error waiting to create function: Error waiting for Creating function: Error code 3, message: Build failed with status: FAILURE and message: requesting https://dl.google.com/runtimes/ubuntu2204/python/python-3.10.12.tar.gz: Get "https://dl.google.com/runtimes/ubuntu2204/python/python-3.10.12.tar.gz": GET https://dl.google.com/runtimes/ubuntu2204/python/python-3.10.12.tar.gz giving up after 4 attempt(s): Get "https://dl.google.com/runtimes/ubuntu2204/python/python-3.10.12.tar.gz": proxyconnect tcp: dial tcp 10.165.144.81:8080: i/o timeout. For more details see the logs at https://console.cloud.google.com/cloud-build/builds;region=us-east4/30c16d78-5744-4f86-bfcb-db6f63b90c79?project=747822733487.
│
│   with module.service_account_strategy.google_cloudfunctions2_function.function["us-east4"],
│   on ../../modules/sa_key_strat/main.tf line 142, in resource "google_cloudfunctions2_function" "function":
│  142: resource "google_cloudfunctions2_function" "function" {

涉事Terraform配置 #

data "google_project" "current" {
  project_id = var.app_project_id
}

data "google_storage_bucket" "upload_bucket" {
  name = "gcf-v2-uploads-${local.project_number}-us-east4"
}

locals {
  project_number = data.google_project.current.number
  upload_bucket  = data.google_storage_bucket.upload_bucket.name
}

resource "google_storage_bucket_object" "object" {
  name   = "hello-world.zip"
  bucket = local.upload_bucket
  source = "hello-world.zip"
}

resource "google_service_account" "runtime" {
  account_id   = "testing-func"
  display_name = "Test SA - used for the cloud function."
  project      = var.app_project_id
}

resource "google_project_iam_member" "invoking" {
  project = var.app_project_id
  role    = "roles/editor"
  member  = "serviceAccount:${google_service_account.runtime.email}"
}

resource "google_cloudfunctions2_function" "function" {
  location    = "us-east4"
  project     = var.app_project_id
  name        = "testing-functions"
  description = "Platform services test deployment, safe to delete."

  build_config {
    runtime     = "python311"
    entry_point = "hello_get"
    environment_variables = {
      HTTP_PROXY              = "OUR PROXY",
      HTTPS_PROXY             = "OUR PROXY",
      NO_PROXY                = "grc.io,pkg.dev"
    }
    source {
      storage_source {
        bucket = local.upload_bucket
        object = google_storage_bucket_object.object.name
      }
    }
    worker_pool = module.cloudbuild_worker_pool_strat.worker_pool_id
  }

  service_config {
    max_instance_count             = 3
    min_instance_count             = 1
    available_memory               = "4Gi"
    timeout_seconds                = 60
    ingress_settings               = "ALLOW_INTERNAL_AND_GCLB"
    vpc_connector                  = "projects/<SHARED PROJECT>/locations/us-east4/connectors/serverless-priv-dev-ue4"
    vpc_connector_egress_settings  = "PRIVATE_RANGES_ONLY"
    all_traffic_on_latest_revision = true
    service_account_email          = google_service_account.runtime.email
  }
}

output "function_uri" {
  value = google_cloudfunctions2_function.function.service_config[0].uri
}

解决思路与建议 #

• 代理连通性排查：日志明确显示代理连接超时，需验证目标项目网络内是否能正常访问代理地址10.165.144.81:8080，同时确认企业代理规则是否允许访问dl.google.com域名。对比正常项目的代理配置，排查项目级防火墙、访问控制列表的差异。
• NO_PROXY规则调整：当前NO_PROXY仅包含grc.io,pkg.dev，但构建过程需要拉取dl.google.com的资源。若该域名无需走代理，需将其添加到NO_PROXY列表，避免代理转发导致的超时。
• Cloud Build Worker Pool权限检查：确认目标项目中Cloud Build Worker Pool的服务账号是否具备访问代理资源、GCP公共资源的权限，对比正常项目的IAM角色配置差异。
• VPC连接器出口配置验证：检查无服务器VPC连接器的出口规则，尤其是设置PRIVATE_RANGES_ONLY时，需确保代理能正确转发外部域名请求，或调整规则允许必要的外部访问。
• 超时与重试机制优化：构建4次尝试后超时，可尝试调整Cloud Build的超时参数，或检查代理服务器的负载情况，排除临时拥堵导致的随机失败。

内容的提问来源于stack exchange，提问作者Cole Gulledge