firebase / firebase/firebase-tools

Can not deploy gen2 trigger cloud functions with custom service account

Open
#6,814 10 comments 0 reactions 1 assignee Assigned to @taeold View on GitHub
api: functions type: bug
Dominant language
TypeScript
Stars
4.5k
Forks
1.3k
Avg merge
1d 12h
Merged PRs (30d)
84

Description

### Environment info

**firebase-tools:** 13.3.1

**Platform:** Debian

### Test case

```javascript
export const automatedBackupFromFirestoreV2 = onSchedule(
{
region: 'europe-west1',
schedule: 'every 168 hours',
serviceAccount: 'compute-engine-default@*****.iam.gserviceaccount.com',
},
async () => {});
```

This happens also with onDocument* firestore triggers, basically anything that uses EventArc. GCloud tool seems to have separate trigger-service-account input argument so it is at least possible to define the service account to be used, but can not get it to work with firebase cloud functions. Have tried using the setGlobalOptions as well, but no luck with that neither.

This used to be an issue with the onCall and onRequest as well, but those now work with the latest version of firebase-tools.

### Steps to reproduce

Have any kind of trigger cloud function and configure it to use custom service account and have a project that does not have the default compute engine service account which EventArc uses when no service account is defined.

### Expected behavior

Deploy works without the error about missing default compute engine service account and the defined service account is used.

### Actual behavior

```bash
[2024-02-25T18:58:14.315Z] Functions deploy failed.
[2024-02-25T18:58:14.315Z] {
"endpoint": {
"id": "automatedBackupFromFirestoreV2",
"project": "*****",
"region": "europe-west1",
"entryPoint": "automatedBackupFromFirestoreV2",
"platform": "gcfv2",
"runtime": "nodejs18",
"scheduleTrigger": {
"schedule": "every 168 hours",
"timeZone": null,
"retryConfig": {}
},
"labels": {
"deployment-tool": "cli-firebase"
},
"ingressSettings": null,
"availableMemoryMb": null,
"serviceAccount": "compute-engine-default@*****.iam.gserviceaccount.com",
"timeoutSeconds": null,
"maxInstances": null,
"minInstances": null,
"concurrency": 80,
"vpc": null,
"environmentVariables": {
"BACKUPS_BUCKET": "\"gs://*****",
"FIREBASE_CONFIG": "{\"projectId\":\"*****\",\"databaseURL\":\"*****\",\"storageBucket\":\"*****\",\"locationId\":\"europe-west\"}",
"GCLOUD_PROJECT": "*****",
"EVENTARC_CLOUD_EVENT_SOURCE": "projects/*****/locations/europe-west1/services/automatedBackupFromFirestoreV2"
},
"codebase": "default",
"cpu": 1,
"securityLevel": "SECURE_ALWAYS",
"targetedByOnly": true,
"hash": "*****",
"uri": "*****",
"runServiceId": "automatedbackupfromfirestorev2"
},
"op": "set invoker",
"original": {
"name": "FirebaseError",
"children": [],
"exit": 1,
"message": "Failed to set the IAM Policy on the Service projects/*****/locations/europe-west1/services/automatedbackupfromfirestorev2",
"original": {
"name": "FirebaseError",
"children": [],
"context": {
"body": {
"error": {
"code": 400,
"message": "Service account -compute@developer.gserviceaccount.com does not exist.",
"status": "INVALID_ARGUMENT"
}
},
"response": {
"statusCode": 400
}
},
"exit": 1,
"message": "HTTP Error: 400, Service account -compute@developer.gserviceaccount.com does not exist.",
"status": 400
},
"status": 400,
"code": 400
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.