如何使用 Deployment Manager 将 IAM 策略设置为 Cloud Function

Question

我想通过 Deployment Manager 部署具有特定 IAM 策略的 Cloud Function。我的部署.yml：

resources:
  - type: gcp-types/cloudfunctions-v1:projects.locations.functions
    name: test-function
    properties:
      parent: projects/test-project/locations/europe-west3
      function: test-function
      entryPoint: functions.KotlinHelloWorld
      timeout: 30s
      availableMemoryMb: 256
      runtime: java11
      location: europe-west3
      sourceArchiveUrl: gs://source-bucket/kotlin-function.zip
      httpsTrigger:
        url: https://europe-west3-test-project.cloudfunctions.net/test-function
      environmentVariables:
        BUCKET: function-results
        RESULT_FILE: dates.txt
    accessControl:
      gcpIamPolicy:
        bindings:
          - role: roles/cloudfunctions.invoker
            members:
              - allUsers

它无需访问控制块即可工作。但在上面的情况下我得到一个错误：

user@pc-003:~/Develop/kotlin-function$ gcloud deployment-manager deployments update learning --config deployment.yml
The fingerprint of the deployment is 6MAQlDoq73-O_QDwSCD7uA==
Waiting for update [operation-1593088111352-5a8e7baf9192b-7d149199-82e96170]...failed.                                                                                                                                                 
ERROR: (gcloud.deployment-manager.deployments.update) Error in Operation [operation-1593088111352-5a8e7baf9192b-7d149199-82e96170]: errors:
- code: RESOURCE_ERROR
  location: /deployments/learning/resources/test-function
  message: '{"ResourceType":"gcp-types/cloudfunctions-v1:projects.locations.functions","ResourceErrorCode":"404","ResourceErrorMessage":{"statusMessage":"Not
    Found","requestPath":"https://cloudfunctions.googleapis.com/v1/:setIamPolicy","httpMethod":"POST"}}'

Answer 1

这是部署管理器和云函数 API 的问题。您可以在这里阅读更多相关信息：https://github.com/GoogleCloudPlatform/deploymentmanager-samples/issues/494

作为解决方法，您可以将函数的 IAM 策略定义为单独的资源：

  - name: [BINDING_NAME]
    type: gcp-types/cloudfunctions-v1:virtual.projects.locations.functions.iamMemberBinding
    properties:
      resource: projects/[PROJECT_NAME]/locations/[LOCATION]/functions/[FUNCTION_NAME]
      role: roles/cloudfunctions.invoker
      member: allUsers

为此，您需要授予Google API 服务代理编辑 IAM 策略的权限。在本例中，Cloud Functions Admin是拥有所有所需权限的角色