GCP Cloud Scheduler 错误，HTTP 目标的状态为 INTERNAL

Question

我有一个调度程序作业，每 8 小时调用一次我的函数。当角色角色/cloudfunctions.invoker 的成员为“allUsers”时，该函数正常工作并返回 HTTP 200 状态。但是，当我通过 serviceAccount:${google_service_account.ServiceAccount.email} 使用我的服务帐户作为成员时，会出现此错误：

{
   insertId: "---"
     jsonPayload: {
       status: "INTERNAL"
       @type: "type.googleapis.com/google.cloud.scheduler.logging.AttemptFinished"
       targetType: "HTTP"
       jobName: "projects/projectname/locations/asia-northeast1/jobs/Function_Name"
       url: "https://asia-northeast1-projectname.cloudfunctions.net/Function_Name"
}
httpRequest: {
   status: 500
}
resource: {
  type: "cloud_scheduler_job"
  labels: {
     project_id: "projectname"
     job_id: "Function_Name"
     location: "asia-northeast1"
  }
}
timestamp: "2021-05-24T08:14:39.131999796Z"
severity: "ERROR"
logName: "projects/projectname/logs/cloudscheduler.googleapis.com%2Fexecutions"
receiveTimestamp: "2021-05-24T08:14:39.131999796Z"
}

调度程序结果为“失败”而不是“成功”。

如何解决此错误？我用于 Google Cloud Platform 的 terraform 版本是 2.20.3。代码如下所示：

resource "google_cloud_scheduler_job" "test" {
  name             = "Function_Name_Schedule_Job"
  description      = "Triggers ${google_cloudfunctions_function.Function_Name.name} function every 8 hours."
  time_zone        = "Asia/Singapore"
  schedule         =  "59 7,15,23 * * *"
  region           = "${var.Region}"
  retry_config {
    retry_count        = 5
    max_retry_duration = "520s"
  }
  http_target  {
    uri                     = "${google_cloudfunctions_function.Function_Name.https_trigger_url}"
    oidc_token {
      service_account_email = "${google_service_account.ServiceAccount.email}"
    }
  }
  depends_on = ["google_cloudfunctions_function.Function_Name"]
}

Answer 1

您需要在oidc_token 定义中添加受众。等于您的 Cloud Functions URL（没有任何额外的路径或参数）

    oidc_token {
      service_account_email = "${google_service_account.ServiceAccount.email}"
      audience = "${google_cloudfunctions_function.Function_Name.https_trigger_url}"
    }