Menu
I am creating a CICD pipeline, via GitHub and Google Cloud Build, using the following .yaml file:
# Cloud Function specifications
steps:
- name: 'gcr.io/cloud-builders/gcloud'
args:
- functions
- deploy
- hello_world
- --source=./src
- --trigger-http
- --memory=1024MB
- --max-instances=5
- --runtime=python39
- --region=europe-west6
- --entry-point=predict
- --allow-unauthenticated
Everything works fine and the function deploys correctly; however, whenever I try to call it, the following error is thrown:
<head>
<meta http-equiv="content-type" content="text/html;charset=utf-8">
<title>401 Unauthorized</title>
</head>
It seems like the --allow-unauthenticated parameter isn't working properly. How can I expose the API and give public access?
Note:
if I run gcloud functions describe --project=XXXXXX --region=europe-west6 hello_world
I get:
availableMemoryMb: 1024
buildId: 1234
entryPoint: predict
environmentVariables:
ABC: '"discount"'
httpsTrigger:
securityLevel: SECURE_OPTIONAL
url: https://europe-west6-XXX.cloudfunctions.net/hello_world
ingressSettings: ALLOW_ALL
labels:
deployment-tool: cli-gcloud
maxInstances: 5
name: projects/XXX/locations/europe-west6/functions/hello_world
runtime: python39
serviceAccountEmail: [email protected]
sourceUploadUrl: https://storage.googleapis.com/gcf-upload-europe-west6XXX
status: ACTIVE
timeout: 60s
updateTime: '2021-06-10T17:09:55.950Z'
versionId: '2'
360
Use of the --allow-unauthenticated flag modifies IAM permissions.
To ensure that unauthorized developers cannot modify function permissions, the user or service that is deploying the function must have the
cloudfunctions.functions.setIamPolicy permission (as noted here).
This aforementioned permission is included in both Owner and Cloud Functions Admin roles. Thus, as soon as the Function Admin role is granted to the Cloud Build Service Account, everything works fine.
137
Please modify cloud build service account permissions and add function admin role, it should work.
20
answered Sep 16 '25 12:09
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With