Harness CICD Google Cloud Function Series 3 (Bucket Trigger)

2 min readMar 22, 2024

Deploying 2nd Gen GCP Cloud Function with Bucket Trigger

Enable all necessary services:

gcloud services enable \
  artifactregistry.googleapis.com \
  cloudfunctions.googleapis.com \
  cloudbuild.googleapis.com \
  eventarc.googleapis.com \
  run.googleapis.com \
  logging.googleapis.com \
  pubsub.googleapis.com

To use Cloud Storage functions, grant the pubsub.publisher IAM role to the Cloud Storage service account:

gcloud config set project [YOUR-PROJECT-ID]

PROJECT_ID=$(gcloud config get-value project)

REGION=us-west1

PROJECT_NUMBER=$(gcloud projects list --filter="project_id:$PROJECT_ID" --format='value(project_number)')

SERVICE_ACCOUNT=$(gsutil kms serviceaccount -p $PROJECT_NUMBER)

#or service-<compute-engine-svc-acc-number>@gs-project-accounts.iam.gserviceaccount.com

gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member serviceAccount:$SERVICE_ACCOUNT \
  --role roles/pubsub.publisher

2nd gen function definition(service)

Harness service manifest for Google Cloud Function deployment. deploying a Google Cloud Function using the Harness service.

function:
  name: <function-name>
  build_config:
    runtime: python39
    entry_point: main
  environment: GEN_2
  service_config:
    environment_variables:
      PROJECT_ID: <gcp-project-id>
      PROCESSED BUCKET_NAME: <some-bucket-name>
      TOPIC_NAME: <some-topic-name>
    service_account_email: <custom-cloud-function-service-name@<gcp-project-id>.iam.gserviceaccount.com>
    vpc_connector: "projects/host-networking123456/locations/<location>/connectors/<connector-name>"
    vpc_connector_egress_settings: "PRIVATE_RANGES_ONLY"
    ingress_settings: "ALLOW_INTERNAL_ONLY"
    available_memory: 512M
    available_cpu: 2
    min_instance_count: 1
    max_instance_count: 1000
    max_instance_request_concurrency: 10
  event_trigger:
    service_account_email: <custom-cloud-function-service-name@<gcp-project-id>.iam.gserviceaccount.com>
    event_type: google.cloud.storage.object.v1.finalized
    event_filters:
      - attribute: bucket
        value: <bucket-that-get-trigger>
  timeout: 180s

Event Trigger Configuration:

service_account_email: The email address of the service account that will be used to execute the function in response to events.
event_type: The type of event that will trigger the function (google.cloud.storage.object.v1.finalized indicates a finalized storage object event).
event_filters: Filters for the event trigger, specifying conditions that must be met for the function to be triggered.
attribute: The attribute of the event being filtered (in this case, bucket).
value: The value that the attribute must match for the event to trigger the function.

Timeout: