部署云功能时从 Artifact Registry 获取 403 Forbidden

Question

我想做的事

我已经将我的私有 npm 包发布到 Artifact Registry 上，下图就是我想要做的。

基本上我想使用来自project-staging 和project-production 的私有包。所以我的package.json 看起来像：

"dependencies": {
  "@<scope>/private_package": "^1.0.0",
},

我做了什么

授予 Cloud Build 服务帐号权限

我在 project-common 的 IAM 菜单下向 <project-staging_id>@cloudbuild.gserviceaccount.com 和 <project-production_id>@cloudbuild.gserviceaccount.com 授予了 artifactregistry.reader 权限。

.npmrc准备工作

cd path/to/project_directory

gcloud artifacts print-settings npm \
    --project=project-common \
    --repository=private_package \
    --location=<location> \
    --scope=@<scope>

vim .npmrc
# => add the output of above gcloud command

npx google-artifactregistry-auth .npmrc

部署

gcloud config configurations activate project-staging

gcloud functions deploy <function_name> --gen2 --region=<region> --trigger-http --runtime=nodejs16 --entry-point=<entry_point>

这给了我以下错误。

ERROR: (gcloud.functions.deploy) OperationError: code=3, message=Build failed with status: FAILURE and message: npm ERR! code E403
npm ERR! 403 403 Forbidden - GET https://<URL>.tgz - Permission "artifactregistry.repositories.downloadArtifacts" denied on resource "<resource_name>" (or it may not exist)

我不知道为什么我会得到这个，即使 <project-staging_id>@cloudbuild.gserviceaccount.com 拥有 artifactregistry.reader 权限。 还有什么我应该做的吗？

Answer 1

通常角色roles/artifactregistry.reader 足以从project_common 上的repo 下载包。

如果project_staging 和project_production 在project_common 上有roles/artifactregistry.reader，它应该可以工作。

roles/artifactregistry.reader 角色包含以下权限：

artifactregistry.repositories.list
artifactregistry.repositories.get
artifactregistry.repositories.downloadArtifacts
artifactregistry.files.list
artifactregistry.files.get
artifactregistry.packages.list
artifactregistry.packages.listTagBindings
artifactregistry.repositories.listEffectiveTags
artifactregistry.packages.list
artifactregistry.tags.list
artifactregistry.tags.get
artifactregistry.versions.list
artifactregistry.versions.get
artifactregistry.locations.list
artifactregistry.locations.get

请再次检查您的配置和执行失败操作的身份。

Answer 2

这是因为我已将.npmrc 添加到.gcloudignore。从.gcloudignore 中删除.npmrc 使其工作。愚蠢的错误。
我将尝试Automate and protect your Cloud Function 作为下一步，但现在我的问题已经解决了:)