firebase / firebase/firebase-tools

When deploying the 2gen function, the configured custom service account does not take effect

Open
#8,841 15 comments 0 reactions 0 assignees View on GitHub
api: functions reproducible triaged type: bug
Dominant language
TypeScript
Stars
4.5k
Forks
1.3k
Avg merge
1d 12h
Merged PRs (30d)
84

Description

### [REQUIRED] Environment info

**firebase-tools**:14.10.1

**Platform**:macOS

**NodeJS**:v22.11.0

**firebase-admin**: ^12.6.0

**firebase-functions**: ^6.0.1

### [REQUIRED] Test case

My Test Project:https://github.com/joeydnomad/default-sa-test

### [REQUIRED] Steps to reproduce

1. Create a new firebase project
2. Run `npm install -g firebase-tools`
3. Run `firebase init`
4. Select `Functions: Configure a Cloud Functions directory and its files`
5. Update index.js to
```js
const { onCall } = require('firebase-functions/v2/https')

const addmessage = onCall((request) => {
return {
message: 'Hello World'
}
})

exports.testGroup = {
addmessage,
}
```
6. Run `firebase deploy --only "functions:testGroup" --project default-sa-test-90b15`
7. Deploy Success✅
8. Delete xxx-compute@developer.gserviceaccount.com service account in CCP Console
9. Create a new service account and grant it the `Editor` role just like default service account
10. Download service account credentials JSON to local
11. Run `export GOOGLE_APPLICATION_CREDENTIALS="/Users/zlh/Downloads/default-sa-test-90b15-fbfd67745aa7.json"` in terminal
12. Run `echo $GOOGLE_APPLICATION_CREDENTIALS`
13. Update index.js to
```js
const { onCall } = require('firebase-functions/v2/https')
const { setGlobalOptions } = require("firebase-functions/v2");

setGlobalOptions({
serviceAccount: "compute-custom@default-sa-test-90b15.iam.gserviceaccount.com",
});

const addmessage = onCall((request) => {
return {
message: 'Hello World'
}
})

exports.testGroup = {
addmessage,
}
```
14. Run `firebase deploy --only "functions:testGroup" --project default-sa-test-90b15` again
15. Got errors❌
```bash
zlh@LihuandeMac-mini functions % firebase deploy --only "functions:testGroup" --project default-sa-test-90b15
(node:26747) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)

=== Deploying to 'default-sa-test-90b15'...

i deploying functions
i functions: preparing codebase default for deployment
i functions: ensuring required API cloudfunctions.googleapis.com is enabled...
i functions: ensuring required API cloudbuild.googleapis.com is enabled...
i artifactregistry: ensuring required API artifactregistry.googleapis.com is enabled...
i functions: Loading and analyzing source code for codebase default to determine what to deploy
Serving at port 8641

i extensions: ensuring required API firebaseextensions.googleapis.com is enabled...
i functions: preparing functions directory for uploading...
i functions: packaged /Users/zlh/代码仓库/个人项目/notes-work/default-sa-test/functions (67.93 KB) for uploading
i functions: ensuring required API run.googleapis.com is enabled...
i functions: ensuring required API eventarc.googleapis.com is enabled...
i functions: ensuring required API pubsub.googleapis.com is enabled...
i functions: ensuring required API storage.googleapis.com is enabled...
i functions: generating the service identity for pubsub.googleapis.com...
i functions: generating the service identity for eventarc.googleapis.com...
✔ functions: functions folder uploaded successfully
i functions: updating Node.js 22 (2nd Gen) function testGroup-addmessage(us-central1)...
⚠ functions: Request to https://cloudfunctions.googleapis.com/v2/projects/default-sa-test-90b15/locations/us-central1/functions/testGroup-addmessage?updateMask=name%2CbuildConfig.runtime%2CbuildConfig.entryPoint%2CbuildConfig.source.storageSource.bucket%2CbuildConfig.source.storageSource.object%2CbuildConfig.environmentVariables%2CbuildConfig.sourceToken%2CserviceConfig.environmentVariables%2CserviceConfig.ingressSettings%2CserviceConfig.timeoutSeconds%2CserviceConfig.serviceAccountEmail%2CserviceConfig.availableMemory%2CserviceConfig.minInstanceCount%2CserviceConfig.maxInstanceCount%2CserviceConfig.maxInstanceRequestConcurrency%2CserviceConfig.availableCpu%2CserviceConfig.vpcConnector%2CserviceConfig.vpcConnectorEgressSettings%2Clabels had HTTP Error: 404, Service account projects/-/serviceAccounts/638315697811-compute@developer.gserviceaccount.com was not found.
⚠ functions: failed to update function projects/default-sa-test-90b15/locations/us-central1/functions/testGroup-addmessage
Failed to update function projects/default-sa-test-90b15/locations/us-central1/functions/testGroup-addmessage

Functions deploy had errors with the following functions:
testGroup-addmessage(us-central1)

Error: There was an error deploying functions

Having trouble? Try again or contact support with contents of firebase-debug.log
```

### [REQUIRED] Expected behavior

Firebase CLI should use the custom service account I set up

### [REQUIRED] Actual behavior
Firebase CLI still using default service account

### PS
I recently wanted to upgrade the code of an old project to the 2gen function, but in the QA environment, I don’t know who deleted the service account xxx-compute@developer.gserviceaccount.com👿, and it has been more than 30 days and cannot be retrieved, so I started looking for a solution, but none of the solutions I found worked. Please help me🥺

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.