Function deploy almost always fails when deploying functions to new Firebase project

[O-K-G]

[REQUIRED] Environment info

firebase-tools: 11.2.0

Platform: Windows 11

[REQUIRED] Test case

npm install -g firebase-tools npm audit fix

Run firebase deploy --only functions,hosting either on new or existing projects.

[REQUIRED] Expected behavior

Just like 11.1.0, it should deploy normally.

[REQUIRED] Actual behavior

For new projects: An error pops up stating that the service account is missing a permission\role to create objects in the cloud. For existing projects: Just a generic "Failed to create function" error is displayed. Rolling back to 11.1.0 resolves the issue.

[google-oss-bot]

This issue does not seem to follow the issue template. Make sure you provide all the required information.

[oande]

Yep, we started seeing issues as well on Mac and Linux, however always with this error message:

Error: Cloud Runtime Config is currently experiencing issues, which is preventing your functions from being deployed. Please wait a few minutes and then try to deploy your functions again.
Run `firebase deploy --except functions` if you want to continue deploying the rest of your project.

Rolling back to 11.1 solved it for us.

[sidsaxena0]

Same here! But for us the error says : Functions deploy had errors with the following functions whereas in firebase console it says : Cloud Functions uses Artifact Registry to store function docker images. Artifact Registry API is not enabled in your project. To enable the API, visit https://console.developers.google.com/apis/api/artifactregistry.googleapis.com/overview?project=XXXXXXX Downgrading project solves the issue by using 11.1.0 using npm i -g firebase-tools@11.1.0 can anybody from firebase team confirm if it's a bug in this release.

[taeold]

@sidsaxena0 I created a new issue for your issue to help us triage the issue better. Thanks for reporting it.

https://github.com/firebase/firebase-tools/issues/4717

[taeold]

@O-K-G I think you are seeing error messages like the one below:

⚠  functions: Upload Error: HTTP Error: 403, <?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message><Details>service-525555247597@gcf-admin-robot.iam.gserviceaccount.com does not have storage.objects.create access to the Google Cloud Storage object.</Details></Error>

Error: HTTP Error: 403, <?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message><Details>service-525555247597@gcf-admin-robot.iam.gserviceaccount.com does not have storage.objects.create access to the Google Cloud Storage object.</Details></Error>
[2022-07-06T21:42:46.330Z] Error Context: {
  "body": {
    "error": {
      "message": "<?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message><Details>service-525555247597@gcf-admin-robot.iam.gserviceaccount.com does not have storage.objects.create access to the Google Cloud Storage object.</Details></Error>"
    }
  },
  "response": {
    "statusCode": 403
  }
}

The issue should go away on your next deploy.

As I understand the issue:

When deploying functions on a new project, the firebase cli tries to enable Google Cloud Functions API. When it does this, the Google Cloud Function platform will create a service account and provision set of permissions for GCF to perform properly. Unfortunately, creating and granting permission isn't an instantaneous process - it takes upward of few minutes.

I think the error message we see above is related to this - that we don't have enough permission to complete the function deployment. I think we can work on providing better experience when deploying firebase function on a freshly minted project. I'll tack on a feature request to this issue for us to look at.

As for problems with deploys on an existing project - I think you are seeing https://github.com/firebase/firebase-tools/issues/4697.

Apologies for disruption to your development work.

[LaCocoRoco]

Same here! But for us the error says : Functions deploy had errors with the following functions whereas in firebase console it says : Cloud Functions uses Artifact Registry to store function docker images. Artifact Registry API is not enabled in your project. To enable the API, visit https://console.developers.google.com/apis/api/artifactregistry.googleapis.com/overview?project=XXXXXXX Downgrading project solves the issue by using 11.1.0 using npm i -g firebase-tools@11.1.0 can anybody from firebase team confirm if it's a bug in this release.

Can confirm. Same issue. Downgrade solves the problem.

[sidsaxena0]

Thanks @taeold !

[O-K-G]

@taeold Thanks! 11.2.1 resolved the issue in my existing project.

[crstffr]

We are also getting the Cloud Runtime Config is currently experiencing issues, which is preventing your functions from being deployed. error using v11.2.1 with Node v16.15.1. Rolling back to v11.1.0 solves the problem for us for now.

Along with the deploy error in v11.2.1, we are also getting Error: Unexpectedly failed to fetch runtime config for project while running firebase functions:config:export

[yuchenshi]

@crstffr Would you mind opening a new issue and fill in the template?

[jenperson]

I experienced the same issue as the original poster:

Upload Error: HTTP Error: 403, <?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message><Details>service-[redacted]@gcf-admin-robot.iam.gserviceaccount.com does not have storage.objects.create access to the Google Cloud Storage bucket.</Details></Error>

I resolved the issue by going to my Firebase project in the console and selecting a Default GCP resource location. I was then able to successfully deploy the function.

[taeold]

@jenperson Mentioned https://github.com/firebase/firebase-tools/issues/4702#issuecomment-1176792078, but your issue might have disappeared only because time passed in between your errored and successful function deploy. In the meantime, the service account in question may have gotten the required permissions (this whole provisioning process takes some time).