How to deploy public function on GCF?

[Micka33]

I can't find the answer anywhere in the documentation. Feel free to point it to me.

$> serverless

  Your Environment Information ---------------------------
     Operating System:          darwin
     Node Version:              12.13.1
     Framework Version:         1.67.0 (standalone)
     Plugin Version:            3.5.0
     SDK Version:               2.3.0
     Components Version:        2.22.3

# serverless.yml
service: my-name

provider:
  name: google
  runtime: nodejs8
  region: europe-west1
  project: project-123456
  credentials: ~/path/to/secret.json

plugins:
  - serverless-google-cloudfunctions
package:
  excludeDevDependencies: true
  exclude:
    - node_modules/**
    - .gitignore
    - .git/**

functions:
  my_name:
    handler: my_name_http
    memorySize: 128
    timeout: 60s
    events:
      - http: path
    labels:
      application: my-name
    environment:
      PROJECT_ID: ${self:provider.project}

Since the last serverless upgrade, my functions are deployed without the "Cloud function invoker" role set to "allUsers".

By the way, I can't find anywhere in the documentation how to set it in serverless.yml.
Can you help me?

N.B.: Of course, I did set it in the Google Cloud Console UI and the function works perfectly. But then, I can no longer do serverless deploy. It displays the following error:

$> serverless deploy
Serverless: Packaging service...
Serverless: Excluding development dependencies...
Serverless: Compiling function "my-name"...
Serverless: Uploading artifacts...
Serverless: Artifacts successfully uploaded...
Serverless: Updating deployment...
Serverless: Checking deployment update progress...
....
  Error --------------------------------------------------

  Error: Deployment failed: RESOURCE_ERROR

       {"ResourceType":"gcp-types/cloudfunctions-v1:projects.locations.functions","ResourceErrorCode":"400","ResourceErrorMessage":{"code":400,"message":"Invalid JSON payload received. Unknown name \"location\" at 'function': Cannot find field.","status":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.BadRequest","fieldViolations":[{"field":"function","description":"Invalid JSON payload received. Unknown name \"location\" at 'function': Cannot find field."}]}],"statusMessage":"Bad Request","requestPath":"https://cloudfunctions.googleapis.com/v1/projects/project-123456/locations/europe-west1/functions/my-name-dev-my-name","httpMethod":"PATCH"}}
      at throwErrorIfDeploymentFails (/Users/username/Documents/remotal/remotal-my-name/node_modules/serverless-google-cloudfunctions/shared/monitorDeployment.js:71:11)
      at /Users/username/Documents/remotal/remotal-my-name/node_modules/serverless-google-cloudfunctions/shared/monitorDeployment.js:42:17
      at processTicksAndRejections (internal/process/task_queues.js:93:5)

     For debugging logs, run again after setting the "SLS_DEBUG=*" environment variable.

  Get Support --------------------------------------------
     Docs:          docs.serverless.com
     Bugs:          github.com/serverless/serverless/issues
     Issues:        forum.serverless.com

  Your Environment Information ---------------------------
     Operating System:          darwin
     Node Version:              12.13.1
     Framework Version:         1.67.0 (standalone)
     Plugin Version:            3.5.0
     SDK Version:               2.3.0
     Components Version:        2.22.3

[bao1018]

@Micka33 it is caused by the location field not supported anymore, please update to latest version and try again

[Micka33]

I don't understand what you mean by update to latest version and try again. I already upgraded to the last version of serverless. I did so before running serverless create --......

• What should I update to the latest version?
• This error only occurs when I manually add a role to a google cloud function through the GCC UI and run serverless deploy.
• I would like to understand how I can specify that I want the role Cloud function invoker set with allUsers when running serverless deploy.

[Micka33]

Up

[iSynthetica]

Have the same issue, after updated serverless and serverless-google-cloudfunctions have an error:

Error: Forbidden
Your client does not have permission to get URL /function from this server

[Micka33]

Does anyone know a way to setup Cloud function invoker to allUsers while deploying with serverless ?

[Trowsing]

Same here, only happens if you upgrade to version 3.0.0, tried downgrading to 2.4.3 and everything was working again with the correct invoker.

[mwawrusch]

It would be nice to have a fix for this. Downgrading to 2.4.3 does not work anymore as Google ended support for the previous API, so we are stuck with 3.0.0.

So what is the correct way to make a function publicly accessible with serverless?

[curtismenmuir]

I am using private cloud functions with Serverless v3.
I have setup a google cloud project which has a Gateway API (App Engine) to sit in front of the private cloud functions. To allow communication between gateway and cloud functions, I have created a Service Account with the Cloud Function Invoker permissions. The gateway will then use a JSON keyfile for that service account to generate an ID Token to be sent as bearer token in request to Cloud Functions.

[pramendra]

The issue is not able setIamPolicy after deployment.

We should be able to configure IAM policy via serverless.yml; similar to AWS.

Up.

[andrx]

+1

[nover]

Also having this problem now after upgrading to google provider 3 here - any fix in the pipeline?

edit

My fix is the following for allowing public access to my cloud function:

Create a policy.json file with the content:

{
  "bindings": [
    {
      "role": "roles/cloudfunctions.invoker",
      "members": [
        "allUsers"
      ]
    }
  ]
}

Ensure that you have the gcloud sdk installed and logged in (gcloud auth login) and then:

$ gcloud functions set-iam-policy --region={YOUR_REGION} {FUNCTION_NAME} policy.json

Updated IAM policy for function [FUNCTION_NAME].
bindings:
- members:
  - allUsers
  role: roles/cloudfunctions.invoker
etag: blah-blah
version: 1

Replacing {YOUR_REGION} and {FUNCTION_NAME} with your own appropriate values.