Cloud Build/Artifact Registry权限错误：cloudbuild.gserviceaccount.com缺失

我在Google Cloud项目gvnalgosoftware（项目ID：511171631078）中遇到部署阻塞问题：通过Cloud Build构建Flask应用为Docker镜像，推送到Artifact Registry后部署至Cloud Run的流程，在执行gcloud builds submit时持续触发权限错误。

问题详情 #

尝试将镜像推送到asia-south1-docker.pkg.dev/gvnalgosoftware/gvn-algo-repo时，收到权限错误提示：cloudbuild.gserviceaccount.com服务账号缺少向指定Artifact Registry上传制品的必要权限。

关键现象 #

• Cloud Build默认服务账号缺失/不可见：在Cloud控制台的IAM与管理员->服务账号页面中，找不到cloudbuild.gserviceaccount.com账号（该账号通常在启用Cloud Build时自动创建）
• 明确的权限拒绝：错误日志显示Permission "artifactregistry.repositories.uploadArtifacts" denied，说明Artifact Registry Writer角色未被授予或已失效
• 部署链中断：Cloud Build任务失败导致新镜像无法推送，Cloud Run日志显示“Image not found”，服务只能继续使用旧版本

已排查操作 #

• 确认gcloud CLI配置正确（项目、区域均匹配）
• 已启用项目的Artifact Registry API和Cloud Build API
• 个人账号xxx@gmail.com拥有项目Owner角色
• 验证app.py、Dockerfile、requirements.txt文件内容最新且逻辑无误
• 已完成Firestore数据迁移，与当前问题无关

相关代码片段 #

Dockerfile #

FROM python:3.11-slim-buster
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r requirements.txt
COPY . .
EXPOSE 8080
CMD ["gunicorn", "-b", "0.0.0.0:${PORT}", "app:app"]

app.py（Firebase/密钥相关片段） #

import os
import json
from firebase_admin import credentials, firestore, initialize_app, auth
from google.cloud import secretmanager
import requests

project_id = os.environ.get('GOOGLE_CLOUD_PROJECT')
client = secretmanager.SecretManagerServiceClient()

def get_secret_value(secret_name):
    try:
        name = f"projects/{project_id}/secrets/{secret_name}/versions/latest"
        response = client.access_secret_version(request={"name": name})
        return response.payload.data.decode("UTF-8")
    except Exception as e:
        print(f"Error accessing secret '{secret_name}': {e}")
        return None

TELEGRAM_BOT_TOKEN = get_secret_value("TELEGRAM_BOT_TOKEN")
ADMIN_TELEGRAM_CHAT_ID = get_secret_value("ADMIN_TELEGRAM_CHAT_ID")
FIREBASE_SERVICE_ACCOUNT_KEY_JSON = get_secret_value("firebase-service-account-key")
FIREBASE_WEB_CONFIG_JSON = get_secret_value("firebase-web-config")

try:
    if not firebase_admin._apps:
        cred_dict = json.loads(FIREBASE_SERVICE_ACCOUNT_KEY_JSON)
        cred = credentials.Certificate(cred_dict)
        firebase_admin.initialize_app(cred)
    db = firestore.client()
except Exception as e:
    print(f"Firebase Admin SDK initialization error: {e}")
    db = None

app = Flask(__name__)
app.secret_key = os.environ.get('FLASK_SECRET_KEY', 'default_super_secret_key')

requirements.txt #

Flask==2.3.3
gunicorn==21.2.0
firebase-admin==6.2.0
google-cloud-firestore==2.21.0
google-cloud-secret-manager==2.16.0
requests==2.31.0
Flask-Cors==4.0.0
google-cloud-storage==3.2.0

标签 #

google-cloud-build google-cloud-run google-cloud-iam google-artifact-registry google-cloud-platform docker flask

内容的提问来源于stack exchange，提问作者Venkat Study info