Allow unauthenticated parameter does not work

user_8618380 0
Viewed 1234

I am creating a CICD pipeline, via GitHub and Google Cloud Build, using the following .yaml file:

# Cloud Function specifications
steps:
- name: 'gcr.io/cloud-builders/gcloud'
  args:
  - functions
  - deploy
  - hello_world
  - --source=./src
  - --trigger-http
  - --memory=1024MB
  - --max-instances=5
  - --runtime=python39
  - --region=europe-west6
  - --entry-point=predict
  - --allow-unauthenticated

Everything works fine and the function deploys correctly; however, whenever I try to call it, the following error is thrown:

<head>
    <meta http-equiv="content-type" content="text/html;charset=utf-8">
    <title>401 Unauthorized</title>
</head>

It seems like the --allow-unauthenticated parameter isn't working properly. How can I expose the API and give public access?

Predict function allows unauthenticated, hello_world doesn't

Note:

if I run gcloud functions describe --project=XXXXXX --region=europe-west6 hello_world

I get:

availableMemoryMb: 1024
buildId: 1234
entryPoint: predict
environmentVariables:
  ABC: '"discount"'
httpsTrigger:
  securityLevel: SECURE_OPTIONAL
  url: https://europe-west6-XXX.cloudfunctions.net/hello_world
ingressSettings: ALLOW_ALL
labels:
  deployment-tool: cli-gcloud
maxInstances: 5
name: projects/XXX/locations/europe-west6/functions/hello_world
runtime: python39
serviceAccountEmail: XXX@appspot.gserviceaccount.com
sourceUploadUrl: https://storage.googleapis.com/gcf-upload-europe-west6XXX
status: ACTIVE
timeout: 60s
updateTime: '2021-06-10T17:09:55.950Z'
versionId: '2'
cicd google-cloud-functions google-cloud-platform yaml
2 Answers

Use of the --allow-unauthenticated flag modifies IAM permissions.

To ensure that unauthorized developers cannot modify function permissions, the user or service that is deploying the function must have the cloudfunctions.functions.setIamPolicy permission (as noted here).

This aforementioned permission is included in both Owner and Cloud Functions Admin roles. Thus, as soon as the Function Admin role is granted to the Cloud Build Service Account, everything works fine.

enter image description here

user_86183800

Please modify cloud build service account permissions and add function admin role, it should work.

user_67785750
Related