GCP 云功能部署因 ArtifactRegistry 错误而失败

Question

当我尝试在特定项目中部署云功能时，出现非常奇怪的错误。 我跑

gcloud config set project <project>
gcloud functions deploy my_cf --entry-point start_process \
--gen2 \
--trigger-http \
--region europe-west1 \
--runtime python310 \
--service-account <service account name>@<project>.iam.gserviceaccount.com \
--no-allow-unauthenticated \
--source=./CloudFunction/

我的服务帐户拥有我猜想的（基于文档）必要的权限，然后是一些：

Artifact Registry Administrator
Cloud Functions Admin
Cloud Run Admin
Eventarc Event Receiver
Eventarc Service Agent
Pub/Sub Publisher
Service Account Token Creator
Storage Admin

但是，我不断收到错误

OperationError: code=13, message=Build failed with status: FAILURE and message: An unexpected error occurred. Refer to build logs: https://console.cloud.google.com/cloud-build/builds;region=europe-west1/<build_id>?project=<project_number>

当我检查云构建日志时，我看到错误消息：

"Step #2 - "build": ERROR: failed to create image cache: accessing cache image 
"europe-west1-docker.pkg.dev/<project>/gcf-artifacts/my--cf/cache:latest": 
connect to repo store "europe-west1-docker.pkg.dev/<project>/gcf-artifacts/<my--cf>/cache:latest": 
GET https://europe-west1-docker.pkg.dev/v2/token?scope=repository%3A<project>%2Fgcf-artifacts%2Fmy--cf%2Fcache%3Apull&service=: 
DENIED: Permission "artifactregistry.repositories.downloadArtifacts" 
denied on resource "projects/<project>/locations/europe-west1/repositories/gcf-artifacts" 
(or it may not exist)"

我尝试更改我自己和服务帐户的权限，但似乎没有什么关系。此外，我在其他项目中做过这个练习，但没有遇到这个问题。 有什么想法是错的吗？

Answer 1

问题似乎在于 Cloud Functions 似乎强制 Cloud Build 使用

${NUMBER}[email protected]

作为其构建作业的服务帐户。解决方案是为该服务帐户提供

artifactregistry.repositories.downloadArtifacts

权限。