Unable to deploy functions using runtime service acct env vars

[amsipe]

Related issues

custom params

[REQUIRED] Version info

node: v16.14.0

firebase-functions: v4.4.0

firebase-tools: 11.30.0

firebase-admin: 11.5.0

[REQUIRED] Test case

Create a .env.<projectId> file.

RUNTIME_SA=[email protected]

Example function:

const { defineString } = require('firebase-functions/params');
const paramSA = defineString('RUNTIME_SA');

const RUNTIME_OPTS = {
  serviceAccount: paramSA,
}
exports.helloWorld = functions.runWith(RUNTIME_OPTS).https.onCall(async (data, context) => {
    return true;
});

[REQUIRED] Steps to reproduce

run firebase deploy --debug --only functions:helloWorld --project <projectId>

[REQUIRED] Expected behavior

Deploy success with serviceAccount linked in config.

[REQUIRED] Actual behavior

"message": "HTTP Error: 400, Invalid function service account requested: {{ params.RUNTIME_SA }}.

Were you able to successfully deploy your functions?

Redacted logs but still show issue:
{
"endpoint": {
"id": "...",
"project": "...",
"region": "us-central1",
"entryPoint": "",
"platform": "gcfv1",
"runtime": "nodejs16",
"callableTrigger": {},
"labels": {
"deployment-tool": "cli-firebase"
},
"serviceAccount": "{{ params.RUNTIME_SA }}",
"ingressSettings": null,
"availableMemoryMb": 128,
"timeoutSeconds": 20,
"maxInstances": null,
"minInstances": null,
"vpc": null,
"environmentVariables": {
"RUNTIME_SA": "[email protected]",
"FIREBASE_CONFIG": "...",
"GCLOUD_PROJECT": "...",
"EVENTARC_CLOUD_EVENT_SOURCE": "..."
},
"codebase": "default",
"securityLevel": "SECURE_OPTIONAL",
"targetedByOnly": true,
"hash": "..."
},
"op": "update",
"original": {
"name": "FirebaseError",
"children": [],
"context": {
"function": "projects//"
},
"exit": 1,
"message": "Failed to update function projects//",
"original": {
"name": "FirebaseError",
"children": [],
"context": {
"body": {
"error": {
"code": 400,
"message": "Invalid function service account requested: {{ params.RUNTIME_SA }}. Please visit https://cloud.google.com/functions/docs/troubleshooting for in-depth troubleshooting documentation.",
"status": "INVALID_ARGUMENT"
}
},
"response": {
"statusCode": 400
}
},
"exit": 1,
"message": "HTTP Error: 400, Invalid function service account requested: {{ params.RUNTIME_SA }}. Please visit https://cloud.google.com/functions/docs/troubleshooting for in-depth troubleshooting documentation.",
"status": 400
},
"status": 400
}
}

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[amsipe]

Forgot to mention that if hard-code the service acct as a string in the RUNTIME_OPTS we are able to deploy. But thats how we had it configured before this release
https://github.com/firebase/firebase-functions/releases/tag/v4.3.0

[taeold]

Hi @amsipe - you can't use params to set service accounts... YET!

I'm going to push to get that feature out this week. Please follow along at firebase/firebase-tools#5224.

Thank you!