【发布时间】：2021-12-09 22:54:52
【问题描述】：
我正在尝试使用 Cloud Run 部署我的 Django 网站，如 Google Cloud Platform's documentation 中所述，但在运行命令 gcloud builds submit --config cloudmigrate.yaml --substitutions _INSTANCE_NAME=trouwfeestwebsite-db,_REGION=europe-west6 时出现错误 Error 403: 934957811880@cloudbuild.gserviceaccount.com does not have storage.objects.get access to the Google Cloud Storage object., forbidden。
命令的完整输出是：（错误在底部）
Creating temporary tarball archive of 119 file(s) totalling 23.2 MiB before compression.
Some files were not included in the source upload.
Check the gcloud log [C:\Users\Sander\AppData\Roaming\gcloud\logs\2021.10.23\20.53.18.638301.log] t
o see which files and the contents of the
default gcloudignore file used (see `$ gcloud topic gcloudignore` to learn
more).
Uploading tarball of [.] to [gs://trouwfeestwebsite_cloudbuild/source/1635015198.74424-eca822c138ec
48878f292b9403f99e83.tgz]
ERROR: (gcloud.builds.submit) INVALID_ARGUMENT: could not resolve source: googleapi: Error 403: 934957811880@cloudbuild.gserviceaccount.com does not have storage.objects.get access to the Google Cloud Storage object., forbidden
在我的存储桶级别，我授予 934957811880@cloudbuild.gserviceaccount.com 存储对象查看器权限，正如我在 https://cloud.google.com/storage/docs/access-control/iam-roles 上看到的那样，这涵盖了 storage.objects.get 访问权限。
我还尝试授予 Storage Object Admin 和 Storage Admin。
我还在 IAM 级别 (https://console.cloud.google.com/iam-admin/iam) 上为 934957811880@cloudbuild.gserviceaccount.com 添加了“查看者”角色，正如 https://stackoverflow.com/a/68303613/5433896 和 https://github.com/google-github-actions/setup-gcloud/issues/105 中所建议的那样，但我觉得给这个帐户这样的帐户有点可疑广泛的作用。
我在 Cloud Build 权限选项卡中启用了 Cloud run：https://console.cloud.google.com/cloud-build/settings/service-account?project=trouwfeestwebsite
通过这些更改，我在运行 gcloud builds submit 命令时仍然遇到相同的错误。
我不明白在凭据/身份验证方面我可能做错了什么 (https://stackoverflow.com/a/68293734/5433896)。自从我初始化该 SDK 以来，我没有更改我的 Google 帐户密码，也没有撤销该帐户对 Google Cloud SDK 的权限。
你知道我错过了什么吗？
我cloudmigrate.yaml的内容是：
steps:
- id: "build image"
name: "gcr.io/cloud-builders/docker"
args: ["build", "-t", "gcr.io/${PROJECT_ID}/${_SERVICE_NAME}", "."]
- id: "push image"
name: "gcr.io/cloud-builders/docker"
args: ["push", "gcr.io/${PROJECT_ID}/${_SERVICE_NAME}"]
- id: "apply migrations"
name: "gcr.io/google-appengine/exec-wrapper"
args:
[
"-i",
"gcr.io/$PROJECT_ID/${_SERVICE_NAME}",
"-s",
"${PROJECT_ID}:${_REGION}:${_INSTANCE_NAME}",
"-e",
"SETTINGS_NAME=${_SECRET_SETTINGS_NAME}",
"--",
"python",
"manage.py",
"migrate",
]
- id: "collect static"
name: "gcr.io/google-appengine/exec-wrapper"
args:
[
"-i",
"gcr.io/$PROJECT_ID/${_SERVICE_NAME}",
"-s",
"${PROJECT_ID}:${_REGION}:${_INSTANCE_NAME}",
"-e",
"SETTINGS_NAME=${_SECRET_SETTINGS_NAME}",
"--",
"python",
"manage.py",
"collectstatic",
"--verbosity",
"2",
"--no-input",
]
substitutions:
_INSTANCE_NAME: trouwfeestwebsite-db
_REGION: europe-west6
_SERVICE_NAME: invites-service
_SECRET_SETTINGS_NAME: django_settings
images:
- "gcr.io/${PROJECT_ID}/${_SERVICE_NAME}"
非常感谢您的帮助。
【问题讨论】：
-
该错误似乎部分来自您的
gcloud builds submit命令。请包括那个。googleapi很好奇。这应该是googleapis，但不清楚为什么gcloud builds submit会引用它。尽管错误显示 GCS，但它是错误的|无法引用错误中的存储桶，因此我认为这可能是一个红鲱鱼（误导）。 -
我的命令是
gcloud builds submit --config cloudmigrate.yaml --substitutions _INSTANCE_NAME=trouwfeestwebsite-db,_REGION=europe-west6。问题中列出了引用的 cloudmigrate.yaml，我错过了哪些其他引用的东西？gcloud --version返回：Google Cloud SDK 361.0.0、bq 2.0.71、核心 2021.10.15、gsutil 5.4。感谢您帮助我！
标签： django google-cloud-platform gcloud google-cloud-run google-cloud-build