无法从GCP Scheduler调用Google Cloud Function [英] Cannot invoke Google Cloud Function from GCP Scheduler

问题描述

我一直试图从GCP调度程序调用GCP函数(--runtime nodejs8 --trigger-http)，这两个函数都位于同一项目中.如果我通过将allUsers成员添加到函数权限中并应用了Cloud Functions-Invoker角色来授予未经身份验证的访问，则只能使其工作.但是，当我仅将调度程序的服务帐户用作Cloud Functions-Invoker时，会出现PERMISSION DENIED错误.

I've been trying to invoke a GCP function (--runtime nodejs8 --trigger-http) from GCP scheduler, both located within the same project. I can only make it work, if I grant unauthenticated access by adding the allUsers member to the functions permissions, with the Cloud Functions-Invoker role applied to it. However, when I only use the service account of the scheduler as the Cloud Functions-Invoker, I get a PERMISSION DENIED Error.

我创建了一个hello world示例，以详细显示我的设置.

I created a hello world example, to show in detail, how my setup looks like.

1. 我设置了一个服务帐户:

gcloud iam service-accounts create scheduler --display-name="Task Schedule Runner"

1. 设置角色:

svc_policy.json:
{
    "bindings": [
      {
        "members": [
          "serviceAccount:[e-mail]"
        ],
        "role": "roles/cloudscheduler.serviceAgent"
      }    
    ]
  }

gcloud iam service-accounts set-iam-policy [e-mail] svc_policy.json  -q

1. 部署云功能:

gcloud functions deploy helloworld --runtime nodejs8 --trigger-http --entry-point=helloWorld

1. 将服务帐户添加为该功能的成员:

gcloud functions add-iam-policy-binding helloworld --member serviceAccount:[e-mail] --role roles/cloudfunctions.invoker

1. 创建调度程序作业:

gcloud beta scheduler jobs create http test-job --schedule "5 * * * *" --http-method=GET --uri=https://us-central1-mwsdata-1544225920485.cloudfunctions.net/helloworld --oidc-service-account-email=[e-mail] --oidc-token-audience=https://us-central1-mwsdata-1544225920485.cloudfunctions.net/helloworld

日志:权限被拒绝

{
 httpRequest: {
 }
 insertId: "1ny5xuxf69w0ck"  
 jsonPayload: {
  @type: "type.googleapis.com/google.cloud.scheduler.logging.AttemptFinished"   
  jobName: "projects/mwsdata-1544225920485/locations/europe-west1/jobs/test-job"   
  status: "PERMISSION_DENIED"   
  targetType: "HTTP"   
  url: "https://us-central1-mwsdata-1544225920485.cloudfunctions.net/helloworld"   
 }
 logName: "projects/mwsdata-1544225920485/logs/cloudscheduler.googleapis.com%2Fexecutions"  
 receiveTimestamp: "2020-02-04T22:05:05.248707989Z"  
 resource: {
  labels: {
   job_id: "test-job"    
   location: "europe-west1"    
   project_id: "mwsdata-1544225920485"    
  }
  type: "cloud_scheduler_job"   
 }
 severity: "ERROR"  
 timestamp: "2020-02-04T22:05:05.248707989Z"  
}

更新

这是对应的设置.

Update

Here are the corresponding settings.

计划程序服务帐户

gcloud iam service-accounts get-iam-policy [e-mail]

bindings:
- members:
  - serviceAccount:[e-mail]
  role: roles/cloudscheduler.serviceAgent
etag: BwWdxuiGNv4=
version: 1

IAM的功能政策:

gcloud functions get-iam-policy helloworld    
bindings:
- members:
  - serviceAccount:[e-mail]
  role: roles/cloudfunctions.invoker
etag: BwWdxyDGOAY=
version: 1

功能说明

gcloud functions describe helloworld
availableMemoryMb: 256
entryPoint: helloWorld
httpsTrigger:
  url: https://us-central1-mwsdata-1544225920485.cloudfunctions.net/helloworld
ingressSettings: ALLOW_ALL
labels:
  deployment-tool: cli-gcloud
name: projects/mwsdata-1544225920485/locations/us-central1/functions/helloworld
runtime: nodejs8
serviceAccountEmail: [e-mail]
sourceUploadUrl: https://storage.googleapis.com/gcf-upload-us-central1-671641e6-3f1b-41a1-9ac1-558224a1638a/b4a0e407-69b9-4f3d-a00d-7543ac33e013.zip?GoogleAccessId=[e-mail]&Expires=1580854835&Signature=S605ODVtOpnU4LIoRT2MnU4OQN3PqhpR0u2CjgcpRcZZUXstQ5kC%2F1rT6Lv2SusvUpBrCcU34Og2hK1QZ3dOPluzhq9cXEvg5MX1MMDyC5Y%2F7KGTibnV4ztFwrVMlZNTj5N%2FzTQn8a65T%2FwPBNUJWK0KrIUue3GemOQZ4l4fCf9v4a9h6MMjetLPCTLQ1BkyFUHrVnO312YDjSC3Ck7Le8OiXb7a%2BwXjTDtbawR20NZWfgCCVvL6iM9mDZSaVAYDzZ6l07eXHXPZfrEGgkn7vXN2ovMF%2BNGvwHvTx7pmur1yQaLM4vRRprjsnErU%2F3p4JO3tlbbFEf%2B69Wd9dyIKVA%3D%3D
status: ACTIVE
timeout: 60s
updateTime: '2020-02-04T21:51:15Z'
versionId: '1'

调度员职位描述

gcloud scheduler jobs describe test-job
attemptDeadline: 180s
httpTarget:
  headers:
    User-Agent: Google-Cloud-Scheduler
  httpMethod: GET
  oidcToken:
    audience: https://us-central1-mwsdata-1544225920485.cloudfunctions.net/helloworld
    serviceAccountEmail: [e-mail]
  uri: https://us-central1-mwsdata-1544225920485.cloudfunctions.net/helloworld
lastAttemptTime: '2020-02-05T09:05:00.054111Z'
name: projects/mwsdata-1544225920485/locations/europe-west1/jobs/test-job
retryConfig:
  maxBackoffDuration: 3600s
  maxDoublings: 16
  maxRetryDuration: 0s
  minBackoffDuration: 5s
schedule: 5 * * * *
scheduleTime: '2020-02-05T10:05:00.085854Z'
state: ENABLED
status:
  code: 7
timeZone: Etc/UTC
userUpdateTime: '2020-02-04T22:02:31Z'

推荐答案

以下是我使Cloud Scheduler触发HTTP触发的Cloud Function不允许未经身份验证的调用的步骤:

Here are the steps I followed to make Cloud Scheduler trigger an HTTP triggered Cloud Function that doesn't allow unauthenticated invocations:

1. 创建服务帐户，该帐户将具有格式为[SA-NAME] @ [PROJECT-ID] .i​​am.gserviceaccount.com.
2. 将服务帐户[SA-NAME] @ [PROJECT-ID] .i​​am.gserviceaccount.com添加为 Cloud Scheduler Admin .
3. 部署不允许公共(未经身份验证)的HTTP触发的Cloud Function )访问权限(如果您使用的是UI，只需取消选中允许未经身份验证的调用"复选框)，然后使用服务帐户字段上最近创建的服务帐户[SA-NAME] @ [PROJECT-ID] .i​​am.gserviceaccount.com(点击并查找服务帐户"字段，默认情况下应将其设置为App Engine默认服务帐户)，并注意Cloud Function的URL.
4. 通过身份验证创建Cloud Scheduler作业，方法是:来自Cloud Shell的以下命令:gcloud scheduler jobs create http [JOB-NAME] --schedule="* * * * *" --uri=[CLOUD-FUNCTIONS-URL] --oidc-service-account-email=[SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com

1. Create a service account, which will have the following form [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com.
2. Adde the service account [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com as a project member and added the following roles to the service account: Cloud Functions Invoker and Cloud Scheduler Admin.
3. Deploy an HTTP triggered Cloud Function that doesn't allow public (unauthenticated) access (if you are using the UI, simply uncheck the Allow unauthenticated Invocations checkbox) and that used the recently created service account [SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com on the Service account field (click more and look for the Service account field, by default it should be set to the App Engine default service account) and take notice of the Cloud Function's URL.
4. Create a Cloud Scheduler job with authentication by issuing the following command from the Cloud Shell: gcloud scheduler jobs create http [JOB-NAME] --schedule="* * * * *" --uri=[CLOUD-FUNCTIONS-URL] --oidc-service-account-email=[SA-NAME]@[PROJECT-ID].iam.gserviceaccount.com

在您的特定情况下，您将为云功能保留默认的App Engine服务帐户.将其更改为您在前面的步骤中指定的创建的服务帐户.

In your specific case you are leaving the default App Engine service account for your Cloud Functions. Change it to the service account you created as specified on the previous steps.

这篇关于无法从GCP Scheduler调用Google Cloud Function的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！