firebase-tools: Cloud Functions deployment failure: `Unable to retrieve the repository metadata`
[REQUIRED] Environment info
firebase-tools: 11.15.0
Platform: macOS
[REQUIRED] Test case
- A fresh firebase project just upgraded to blaze plan
- Run a
firebase deploycommand to deploy 27 Cloud Functions of https://github.com/quadratic-funding/mpc-phase2-suite/ at once
[REQUIRED] Steps to reproduce
- Create a new Firebase project
- Upgrade to Blaze plan
- Login to owner account of a new project by running
firebase logincommand - Try to deploy Cloud Functions of https://github.com/quadratic-funding/mpc-phase2-suite/ by following command:
git clone https://github.com/quadratic-funding/mpc-phase2-suite/
cd mpc-phase2-suite
git checkout 7fcd2291b61d23d2665c597e500f8b705986913f
cd firebase
firebase deploy --only functions
[REQUIRED] Expected behavior
Successful deployment
[REQUIRED] Actual behavior
Failed to deploy 26 of 27 Cloud Functions. Service account of Cloud Functions doesn’t had a proper permission to retrieve the repository metadata when it failing
“Unable to retrieve the repository metadata for projects/redacted/locations/us-central1/repositories/gcf-artifacts. Ensure that the Cloud Functions service account has ‘artifactregistry.repositories.list’ and ‘artifactregistry.repositories.get’ permissions. You can add the permissions by granting the role ‘roles/artifactregistry.reader’.”
CLI log:
$ firebase deploy --only functions
=== Deploying to 'redacted'...
i deploying functions
Running command: yarn --prefix "$RESOURCE_DIR" build
yarn run v1.22.19
$ tsc
✨ Done in 2.08s.
✔ functions: Finished running predeploy script.
i functions: ensuring required API cloudfunctions.googleapis.com is enabled...
i functions: ensuring required API cloudbuild.googleapis.com is enabled...
i artifactregistry: ensuring required API artifactregistry.googleapis.com is enabled...
⚠ artifactregistry: missing required API artifactregistry.googleapis.com. Enabling now...
⚠ functions: missing required API cloudbuild.googleapis.com. Enabling now...
⚠ functions: missing required API cloudfunctions.googleapis.com. Enabling now...
✔ functions: required API cloudfunctions.googleapis.com is enabled
✔ artifactregistry: required API artifactregistry.googleapis.com is enabled
✔ functions: required API cloudbuild.googleapis.com is enabled
i functions: preparing codebase default for deployment
i functions: Loaded environment variables from .env.
i functions: preparing . directory for uploading...
i functions: packaged /mpc-phase2-suite/firebase (103.99 KB) for uploading
i functions: packaged /mpc-phase2-suite/firebase (104.2 KB) for uploading
i functions: ensuring required API cloudscheduler.googleapis.com is enabled...
⚠ functions: missing required API cloudscheduler.googleapis.com. Enabling now...
✔ functions: required API cloudscheduler.googleapis.com is enabled
i functions: ensuring required API run.googleapis.com is enabled...
i functions: ensuring required API eventarc.googleapis.com is enabled...
i functions: ensuring required API pubsub.googleapis.com is enabled...
i functions: ensuring required API storage.googleapis.com is enabled...
⚠ functions: missing required API eventarc.googleapis.com. Enabling now...
⚠ functions: missing required API run.googleapis.com. Enabling now...
✔ functions: required API pubsub.googleapis.com is enabled
✔ functions: required API storage.googleapis.com is enabled
✔ functions: required API eventarc.googleapis.com is enabled
✔ functions: required API run.googleapis.com is enabled
i functions: generating the service identity for pubsub.googleapis.com...
i functions: generating the service identity for eventarc.googleapis.com...
✔ functions: . folder uploaded successfully
i functions: creating Node.js 16 function checkAndPrepareCoordinatorForFinalization(us-central1)...
i functions: creating Node.js 16 function checkAndRemoveBlockingContributor(us-central1)...
i functions: creating Node.js 16 function checkIfObjectExist(us-central1)...
i functions: creating Node.js 16 function checkParticipantForCeremony(us-central1)...
i functions: creating Node.js 16 function completeMultiPartUpload(us-central1)...
i functions: creating Node.js 16 function coordinateContributors(us-central1)...
i functions: creating Node.js 16 function createBucket(us-central1)...
i functions: creating Node.js 16 function finalizeCeremony(us-central1)...
i functions: creating Node.js 16 function finalizeLastContribution(us-central1)...
i functions: creating Node.js 16 function generateGetObjectPreSignedUrl(us-central1)...
i functions: creating Node.js 16 function generatePreSignedUrlsParts(us-central1)...
i functions: creating Node.js 16 function initEmptyWaitingQueueForCircuit(us-central1)...
i functions: creating Node.js 16 function makeProgressToNextContribution(us-central1)...
i functions: creating Node.js 16 function permanentlyStoreCurrentContributionTimeAndHash(us-central1)...
i functions: creating Node.js 16 function processSignUpWithCustomClaims(us-central1)...
i functions: creating Node.js 16 function progressToNextContributionStep(us-central1)...
i functions: creating Node.js 16 function refreshParticipantAfterContributionVerification(us-central1)...
i functions: creating Node.js 16 function registerAuthUser(us-central1)...
i functions: creating Node.js 16 function resumeContributionAfterTimeoutExpiration(us-central1)...
i functions: creating Node.js 16 function setupCeremony(us-central1)...
i functions: creating Node.js 16 function startCeremony(us-central1)...
i functions: creating Node.js 16 function startMultiPartUpload(us-central1)...
i functions: creating Node.js 16 function stopCeremony(us-central1)...
i functions: creating Node.js 16 function temporaryStoreCurrentContributionComputationTime(us-central1)...
i functions: creating Node.js 16 function temporaryStoreCurrentContributionMultiPartUploadId(us-central1)...
i functions: creating Node.js 16 function temporaryStoreCurrentContributionUploadedChunkData(us-central1)...
i functions: creating Node.js 16 function verifycontribution(us-central1)...
⚠ functions: failed to create function projects/redacted/locations/us-central1/functions/checkAndPrepareCoordinatorForFinalization
Failed to create function projects/redacted/locations/us-central1/functions/checkAndPrepareCoordinatorForFinalization
✔ functions[verifycontribution(us-central1)] Successful create operation.
Cloud Functions side Log
Following is a log of checkAndPrepareCoordinatorForFinalization function:
protoPayload: {
@type: "type.googleapis.com/google.cloud.audit.AuditLog"
status: {
code: 7
message: "Unable to retrieve the repository metadata for projects/redacted/locations/us-central1/repositories/gcf-artifacts. Ensure that the Cloud Functions service account has 'artifactregistry.repositories.list' and 'artifactregistry.repositories.get' permissions. You can add the permissions by granting the role 'roles/artifactregistry.reader'."
}
authenticationInfo: {1}
requestMetadata: {4}
serviceName: "cloudfunctions.googleapis.com"
methodName: "google.cloud.functions.v1.CloudFunctionsService.CreateFunction"
authorizationInfo: [1]
resourceName: "projects/redacted/locations/us-central1/functions/checkAndPrepareCoordinatorForFinalization"
request: {
@type: "type.googleapis.com/google.cloud.functions.v1.CreateFunctionRequest"
function: {7}
location: "projects/redacted/locations/us-central1"
}
resourceLocation: {1}
}
receiveTimestamp: "2022-11-14T04:34:00.016225233Z"
resource: {2}
severity: "ERROR"
timestamp: "2022-11-14T04:33:59.205589Z"
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Reactions: 1
- Comments: 37 (8 by maintainers)
Retrying actually did the trick for me!
Sent from my iPhone
On 30 Nov 2022, at 22:36, Daniel Lee @.***> wrote:
@gurrpihttps://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fgurrpi&data=05|01||c079736fdace4352396808dad31af5ab|84df9e7fe9f640afb435aaaaaaaaaaaa|1|0|638054409988593049|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=cNHLs9Oe3Jpt0aXZXebxWqNMYJg0Bm%2FxBDA01O1d%2FWc%3D&reserved=0 @Vlufhttps://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FVluf&data=05|01||c079736fdace4352396808dad31af5ab|84df9e7fe9f640afb435aaaaaaaaaaaa|1|0|638054409988593049|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=gGetLpyZ6WNYmNu0cVGXa5fm%2BnJ6%2Fzv6g3boI%2BlaeYQ%3D&reserved=0 Looking into the issue.
message: “Unable to retrieve the repository metadata for projects/redacted/locations/us-central1/repositories/gcf-artifacts. Ensure that the Cloud Functions service account has ‘artifactregistry.repositories.list’ and ‘artifactregistry.repositories.get’ permissions. You can add the permissions by granting the role ‘roles/artifactregistry.reader’.”
Since I’m having trouble reproducing the issue (which usually is the case for permission related problems), is this happening consistently on your function deploys? Or, maybe, is it happening when you are trying to deploy your functions on a fresh project?
If this is only affecting deployments to a relatively new project, I suspect the issue is because it takes time for GCP IAM permissions grants to propagate.
— Reply to this email directly, view it on GitHubhttps://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ffirebase%2Ffirebase-tools%2Fissues%2F5244%23issuecomment-1332762870&data=05|01||c079736fdace4352396808dad31af5ab|84df9e7fe9f640afb435aaaaaaaaaaaa|1|0|638054409988593049|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=97jR6zGs7cmH8La8l8hZS7vhhz6pjxBmAKJWw6CbhqQ%3D&reserved=0, or unsubscribehttps://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FABHPJVN35NFV6JW7TT6IIDDWK7CGJANCNFSM6AAAAAASBJ4EMU&data=05|01||c079736fdace4352396808dad31af5ab|84df9e7fe9f640afb435aaaaaaaaaaaa|1|0|638054409988593049|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D|3000|||&sdata=zngfuYjwc7GvECnvcX4n0WsLbjGks96hfQP1dusut1o%3D&reserved=0. You are receiving this because you were mentioned.Message ID: @.***>
The fix for me was to add
roles/artifactregistry.createOnPushRepoAdminrole tofirebase-service-account@firebase-sa-management.iam.gserviceaccount.comonhttps://console.cloud.google.com/iam-admin/iam?authuser=0&project=PROJECTID
I had the same issue, not related to Blaze plan nor credit card issue. It said
As some one put it above, I just tried it again. Then it worked. Don’t know why.
I got the same issue again:
im having the same problem
I checked the Blaze plan and noticed the credit card setting was incorrect. After fixing the credit card issue, it works well.
It helped for me to upgrade to ‘Blaze’ plan
I have the same issue
I have the same problem. I think it might be permission propagation problem as @taeold pointed out.
So, I left it for a few hours and went to delete the cloud function manually (https://console.cloud.google.com/functions/list ) and ran the command again and it is working now.