如何使用Deployment Manager将IAM策略设置为Cloud Function

我想通过Deployment Manager部署具有特定IAM策略的Cloud Function。我的 deployment.yml

resources:
  - type: gcp-types/cloudfunctions-v1:projects.locations.functions
    name: test-function
    properties:
      parent: projects/test-project/locations/europe-west3
      function: test-function
      entryPoint: functions.KotlinHelloWorld
      timeout: 30s
      availableMemoryMb: 256
      runtime: java11
      location: europe-west3
      sourceArchiveUrl: gs://source-bucket/kotlin-function.zip
      httpsTrigger:
        url: https://europe-west3-test-project.cloudfunctions.net/test-function
      environmentVariables:
        BUCKET: function-results
        RESULT_FILE: dates.txt
    accessControl:
      gcpiamPolicy:
        bindings:
          - role: roles/cloudfunctions.invoker
            members:
              - allUsers

它在没有 accessControl 块的情况下有效。但是在上面的情况下,我得到一个错误:

user@pc-003:~/Develop/kotlin-function$ gcloud deployment-manager deployments update learning --config deployment.yml
The fingerprint of the deployment is 6MAQlDoq73-O_QDwSCD7uA==
Waiting for update [operation-1593088111352-5a8e7baf9192b-7d149199-82e96170]...failed.                                                                                                                                                 
ERROR: (gcloud.deployment-manager.deployments.update) Error in Operation [operation-1593088111352-5a8e7baf9192b-7d149199-82e96170]: errors:
- code: RESOURCE_ERROR
  location: /deployments/learning/resources/test-function
  message: '{"ResourceType":"gcp-types/cloudfunctions-v1:projects.locations.functions","ResourceErrorCode":"404","ResourceErrorMessage":{"statusMessage":"Not
    Found","requestPath":"https://cloudfunctions.googleapis.com/v1/:setIamPolicy","httpMethod":"POST"}}'
iCMS 回答:如何使用Deployment Manager将IAM策略设置为Cloud Function

这是Deployment Manager和云功能API的问题。您可以在这里了解更多信息:https://github.com/GoogleCloudPlatform/deploymentmanager-samples/issues/494

作为解决方法,您可以将功能的IAM策略定义为单独的资源:

  - name: [BINDING_NAME]
    type: gcp-types/cloudfunctions-v1:virtual.projects.locations.functions.iamMemberBinding
    properties:
      resource: projects/[PROJECT_NAME]/locations/[LOCATION]/functions/[FUNCTION_NAME]
      role: roles/cloudfunctions.invoker
      member: allUsers

为此,您需要授予 Google API服务代理权限以编辑IAM策略。在这种情况下, Cloud Functions Admin 是具有所有必需权限的角色

本文链接:https://www.f2er.com/2058959.html

大家都在问