From a18c942898dc3c69a7aae8850036496d06397f17 Mon Sep 17 00:00:00 2001 From: Nikolai Kondrashov Date: Tue, 5 Nov 2024 14:21:16 +0200 Subject: [PATCH] cloud: Work around broken unauthenticated functions --- kcidb/cloud/function.sh | 90 ++++++++++++++++++++++++++++++++++++---- kcidb/cloud/functions.sh | 15 ++++--- 2 files changed, 88 insertions(+), 17 deletions(-) diff --git a/kcidb/cloud/function.sh b/kcidb/cloud/function.sh index c8e40973..62c0b372 100644 --- a/kcidb/cloud/function.sh +++ b/kcidb/cloud/function.sh @@ -9,25 +9,97 @@ declare _FUNCTION_SH= # The region used to host our Cloud Functions declare -r FUNCTION_REGION="us-central1" +# Add a function's IAM policy binding +# Args: project prefix name member role +function function_iam_policy_binding_deploy() { + declare -r project="$1"; shift + declare -r prefix="$1"; shift + declare -r name="$1"; shift + declare -r member="$1"; shift + declare -r role="$1"; shift + mute gcloud functions add-iam-policy-binding \ + --quiet --project="$project" \ + "${prefix}${name}" \ + --region="$FUNCTION_REGION" \ + --member="$member" \ + --role="$role" +} + +# Delete a function's IAM policy binding, if it exists +# Args: project prefix name member role +function function_iam_policy_binding_withdraw() { + declare -r project="$1"; shift + declare -r prefix="$1"; shift + declare -r name="$1"; shift + declare -r member="$1"; shift + declare -r role="$1"; shift + declare output + if ! output=$( + gcloud functions remove-iam-policy-binding \ + --quiet --project="$project" \ + "${prefix}${name}" \ + --region="$FUNCTION_REGION" \ + --member="$member" \ + --role="$role" 2>&1 + ) && [[ $output != *\ not\ found!* ]]; then + echo "$output" >&2 + false + fi +} + +# Deploy a Cloud Function regardless if its section is enabled or not. +# Args: source project prefix name auth [param_arg...] +# Where "auth" is either "true" or "false" for an authenticated and +# unauthenticated deployment respectively. +function function_deploy_unconditional() { + declare -r source="$1"; shift + declare -r project="$1"; shift + declare -r prefix="$1"; shift + declare -r name="$1"; shift + declare -r auth="$1"; shift + declare iam_action + + assert test "$auth" = "true" -o "$auth" = "false" + + # TODO Upgrade to gen2 + mute gcloud functions deploy --quiet --project="$project" \ + --region="$FUNCTION_REGION" \ + --docker-registry=artifact-registry \ + --runtime python39 \ + --no-gen2 \ + --source "$source" "${prefix}${name}" \ + --entry-point "kcidb_${name}" \ + "$@" + + # Work around broken --allow-unauthenticated option + if "$auth"; then + iam_action="withdraw" + else + iam_action="deploy" + fi + "function_iam_policy_binding_$iam_action" \ + "$project" "$prefix" "$name" "allUsers" "roles/cloudfunctions.invoker" +} + # Deploy a Cloud Function -# Args: sections source project prefix name [param_arg...] +# Args: sections source project prefix name auth [param_arg...] +# Where "auth" is either "true" or "false" for an authenticated and +# unauthenticated deployment respectively. function function_deploy() { declare -r sections="$1"; shift declare -r source="$1"; shift declare -r project="$1"; shift declare -r prefix="$1"; shift declare -r name="$1"; shift + declare -r auth="$1"; shift + + assert test "$auth" = "true" -o "$auth" = "false" + # TODO Upgrade to gen2 sections_run_explicit "$sections" \ "functions.$name" deploy \ - mute gcloud functions deploy --quiet --project="$project" \ - --region="$FUNCTION_REGION" \ - --docker-registry=artifact-registry \ - --runtime python39 \ - --no-gen2 \ - --source "$source" "${prefix}${name}" \ - --entry-point "kcidb_${name}" \ - "$@" + function_deploy_unconditional "$source" "$project" "$prefix" \ + "$name" "$auth" "$@" } # Delete a Cloud Function (without complaining it doesn't exist). diff --git a/kcidb/cloud/functions.sh b/kcidb/cloud/functions.sh index bd9f7548..d9eff196 100644 --- a/kcidb/cloud/functions.sh +++ b/kcidb/cloud/functions.sh @@ -172,7 +172,7 @@ function functions_deploy() { declare trigger_resource="projects/$project/databases/(default)/documents/" trigger_resource+="${spool_collection_path}/{notification_id}" function_deploy "$sections" "$source" "$project" "$prefix" \ - purge_db \ + purge_db true \ --env-vars-file "$env_yaml_file" \ --trigger-topic "${purge_db_trigger_topic}" \ --memory 256MB \ @@ -180,7 +180,7 @@ function functions_deploy() { --timeout 540 function_deploy "$sections" "$source" "$project" "$prefix" \ - pick_notifications \ + pick_notifications true \ --env-vars-file "$env_yaml_file" \ --trigger-topic "${pick_notifications_trigger_topic}" \ --memory 256MB \ @@ -188,7 +188,7 @@ function functions_deploy() { --timeout 540 function_deploy "$sections" "$source" "$project" "$prefix" \ - send_notification \ + send_notification true \ --env-vars-file "$env_yaml_file" \ --trigger-event "${trigger_event}" \ --trigger-resource "${trigger_resource}" \ @@ -198,7 +198,7 @@ function functions_deploy() { --timeout 540 function_deploy "$sections" "$source" "$project" "$prefix" \ - spool_notifications \ + spool_notifications true \ --env-vars-file "$env_yaml_file" \ --trigger-topic "${updated_topic}" \ --memory 4096MB \ @@ -206,16 +206,15 @@ function functions_deploy() { --timeout 540 function_deploy "$sections" "$source" "$project" "$prefix" \ - "$cache_redirect_function_name" \ + "$cache_redirect_function_name" false \ --env-vars-file "$env_yaml_file" \ --trigger-http \ - --allow-unauthenticated \ --memory 256MB \ --max-instances=16 \ --timeout 30 function_deploy "$sections" "$source" "$project" "$prefix" \ - cache_urls \ + cache_urls true \ --env-vars-file "$env_yaml_file" \ --trigger-topic "${updated_urls_topic}" \ --memory 512MB \ @@ -223,7 +222,7 @@ function functions_deploy() { --timeout 540 function_deploy "$sections" "$source" "$project" "$prefix" \ - load_queue \ + load_queue true \ --env-vars-file "$env_yaml_file" \ --trigger-topic "${load_queue_trigger_topic}" \ --memory 1024MB \