Cloud Run Fails on Step-2 Deploy with Permissions Error

user_4945948 0
Viewed 308

I am having a heck of a time getting Cloud Run to work correctly. I am creating a new service from the GCP console with a Cloud Build trigger to my Github repo. Under the security tab, I am setting the service account to one of my service accounts which has the following permissions:

  1. Cloud Build Service Account
  2. Cloud Run Admin
  3. Cloud Run Service Agent
  4. Cloud Scheduler Service Agent
  5. Service Account User

When I create the service, it always ends with the following error:

Step #2 - "Deploy": ERROR: (gcloud.run.services.update) PERMISSION_DENIED: Permission 'run.services.get' denied on resource 'namespaces/project/services/cloud_run_service_name' (or resource may not exist).

I can't figure out why I am getting this error. The service account has all the permissions listed in the Cloud Run documentation. Any ideas?

google-cloud-run google-cloud-platform
2 Answers

Since you are using Cloud Build to deploy the Cloud Run service, the Cloud Build service account must have the appropriate permissions over Cloud Run. You are only specifying that you are adding the permission to "one of my service accounts", but it must be the one used by Cloud Build. The error that you get indicates that the Cloud Build service account does not have the right permissions so you must have set them for the wrong one.

You should add the role Cloud Run Admin (roles/run.admin) to the service account used by Cloud Build.

user_142481160

I found out what the problem was. I was assuming that I should setup everything from Cloud Run, including my Cloud Build trigger since the Cloud Run interface offers that capability. Setting up the Cloud Build Trigger from Cloud Run doesn't take into account the service account that should be controlling the trigger.

The solution was to do everything from Cloud Build where I am able to specify the service account for the trigger and use a cloudbuild.yaml to control deploying to a Cloud Run service.

user_49459480
Related