Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Creation of Github Actions workflow fails due to max number of keys limit for service account #6145

Closed
hugo2410 opened this issue Jul 18, 2023 · 6 comments
Assignees
Labels

Comments

@hugo2410
Copy link

hugo2410 commented Jul 18, 2023

[REQUIRED] Environment info

11.25.2

11.25.2

Ubuntu 22.04

[REQUIRED] Test case

I had setup the github actions workflow succesfully in the past, I decided to remove it directly in git, without changing the config in firebase and when i try to set it up again it fails. I have removed the secrets for the repo and have deleted the service account called githubactions-*****

[REQUIRED] Steps to reproduce

firebase init hosting:github --debug

[REQUIRED] Expected behavior

Workflow succeeds and sets up github actions

[REQUIRED] Actual behavior

2023-07-18T16:53:55.604Z] >>> [apiv2][query] POST https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts/[email protected]/keys [none]
[2023-07-18T16:53:55.605Z] >>> [apiv2][body] POST https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts/[email protected]/keys {"keyAlgorithm":"KEY_ALG_UNSPECIFIED","privateKeyType":"TYPE_GOOGLE_CREDENTIALS_FILE"}
⠼ Retrieving a service account.[2023-07-18T16:53:56.419Z] <<< [apiv2][status] POST https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts/[email protected]/keys 400
[2023-07-18T16:53:56.419Z] <<< [apiv2][body] POST https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts/[email protected]/keys {"error":{"code":400,"message":"Precondition check failed.","status":"FAILED_PRECONDITION"}}

Error: HTTP Error: 400, Precondition check failed.
[2023-07-18T16:53:56.567Z] Error Context: {
"body": {
"error": {
"code": 400,
"message": "Precondition check failed.",
"status": "FAILED_PRECONDITION"
}
},
"response": {
"statusCode": 400
}
}
I didnt post the full logs as I'm worried there might be some secrets to access my repo

@google-oss-bot
Copy link
Contributor

This issue does not have all the information required by the template. Looks like you forgot to fill out some sections. Please update the issue with more information.

@aalej
Copy link
Contributor

aalej commented Jul 25, 2023

Hi @hugo2410, I’m trying to repro the issue you’re encountering, but so far, I’m unable to replicate the error you mentioned.

After setting up the GitHub Action using firebase init hosting:github and pushing the code to a GitHub repository, I deleted the directory for the GitHub action. I tried to run firebase init hosting:github and no issues were encountered.

Could you let me know if I’m missing anything here to properly replicate the issue? It would be helpful if you could provide details on the steps you took. Also, from what I can tell you’re using firebase-tools v11.25.2. I would recommend upgrading to the latest version, which is currently v12.4.5, to see if you would still encounter the issue.

@aalej aalej added the Needs: Author Feedback Issues awaiting author feedback label Jul 25, 2023
@hugo2410
Copy link
Author

`? For which GitHub repository would you like to set up a GitHub workflow? (format: user/repository) portato-io/portatoapp
[2023-07-25T14:14:30.693Z] >>> [apiv2][query] GET https://api.github.com/repos/portato-io/portatoapp [none]
[2023-07-25T14:14:30.998Z] <<< [apiv2][status] GET https://api.github.com/repos/portato-io/portatoapp 200
[2023-07-25T14:14:30.999Z] <<< [apiv2][body] GET https://api.github.com/repos/portato-io/portatoapp {"id":610901815,"node_id":"R_kgDOJGmfNw","name":"portatoapp","full_name":"portato-io/portatoapp","private":false,"owner":{"login":"portato-io","id":127239963,"node_id":"O_kgDOB5WHGw","avatar_url":"https://avatars.githubusercontent.com/u/127239963?v=4","gravatar_id":"","url":"https://api.github.com/users/portato-io","html_url":"https://github.com/portato-io","followers_url":"https://api.github.com/users/portato-io/followers","following_url":"https://api.github.com/users/portato-io/following{/other_user}","gists_url":"https://api.github.com/users/portato-io/gists{/gist_id}","starred_url":"https://api.github.com/users/portato-io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/portato-io/subscriptions","organizations_url":"https://api.github.com/users/portato-io/orgs","repos_url":"https://api.github.com/users/portato-io/repos","events_url":"https://api.github.com/users/portato-io/events{/privacy}","received_events_url":"https://api.github.com/users/portato-io/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/portato-io/portatoapp","description":null,"fork":false,"url":"https://api.github.com/repos/portato-io/portatoapp","forks_url":"https://api.github.com/repos/portato-io/portatoapp/forks","keys_url":"https://api.github.com/repos/portato-io/portatoapp/keys{/key_id}","collaborators_url":"https://api.github.com/repos/portato-io/portatoapp/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/portato-io/portatoapp/teams","hooks_url":"https://api.github.com/repos/portato-io/portatoapp/hooks","issue_events_url":"https://api.github.com/repos/portato-io/portatoapp/issues/events{/number}","events_url":"https://api.github.com/repos/portato-io/portatoapp/events","assignees_url":"https://api.github.com/repos/portato-io/portatoapp/assignees{/user}","branches_url":"https://api.github.com/repos/portato-io/portatoapp/branches{/branch}","tags_url":"https://api.github.com/repos/portato-io/portatoapp/tags","blobs_url":"https://api.github.com/repos/portato-io/portatoapp/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/portato-io/portatoapp/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/portato-io/portatoapp/git/refs{/sha}","trees_url":"https://api.github.com/repos/portato-io/portatoapp/git/trees{/sha}","statuses_url":"https://api.github.com/repos/portato-io/portatoapp/statuses/{sha}","languages_url":"https://api.github.com/repos/portato-io/portatoapp/languages","stargazers_url":"https://api.github.com/repos/portato-io/portatoapp/stargazers","contributors_url":"https://api.github.com/repos/portato-io/portatoapp/contributors","subscribers_url":"https://api.github.com/repos/portato-io/portatoapp/subscribers","subscription_url":"https://api.github.com/repos/portato-io/portatoapp/subscription","commits_url":"https://api.github.com/repos/portato-io/portatoapp/commits{/sha}","git_commits_url":"https://api.github.com/repos/portato-io/portatoapp/git/commits{/sha}","comments_url":"https://api.github.com/repos/portato-io/portatoapp/comments{/number}","issue_comment_url":"https://api.github.com/repos/portato-io/portatoapp/issues/comments{/number}","contents_url":"https://api.github.com/repos/portato-io/portatoapp/contents/{+path}","compare_url":"https://api.github.com/repos/portato-io/portatoapp/compare/{base}...{head}","merges_url":"https://api.github.com/repos/portato-io/portatoapp/merges","archive_url":"https://api.github.com/repos/portato-io/portatoapp/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/portato-io/portatoapp/downloads","issues_url":"https://api.github.com/repos/portato-io/portatoapp/issues{/number}","pulls_url":"https://api.github.com/repos/portato-io/portatoapp/pulls{/number}","milestones_url":"https://api.github.com/repos/portato-io/portatoapp/milestones{/number}","notifications_url":"https://api.github.com/repos/portato-io/portatoapp/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/portato-io/portatoapp/labels{/name}","releases_url":"https://api.github.com/repos/portato-io/portatoapp/releases{/id}","deployments_url":"https://api.github.com/repos/portato-io/portatoapp/deployments","created_at":"2023-03-07T17:57:53Z","updated_at":"2023-06-08T08:58:21Z","pushed_at":"2023-07-24T09:44:14Z","git_url":"git://github.com/portato-io/portatoapp.git","ssh_url":"[email protected]:portato-io/portatoapp.git","clone_url":"https://github.com/portato-io/portatoapp.git","svn_url":"https://github.com/portato-io/portatoapp","homepage":null,"size":122030,"stargazers_count":3,"watchers_count":3,"language":"TypeScript","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"has_discussions":false,"forks_count":0,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":37,"license":null,"allow_forking":true,"is_template":false,"web_commit_signoff_required":false,"topics":[],"visibility":"public","forks":0,"open_issues":37,"watchers":3,"default_branch":"main","permissions":{"admin":true,"maintain":true,"push":true,"triage":true,"pull":true},"temp_clone_token":"","allow_squash_merge":true,"allow_merge_commit":true,"allow_rebase_merge":true,"allow_auto_merge":false,"delete_branch_on_merge":false,"allow_update_branch":false,"use_squash_pr_title_as_default":false,"squash_merge_commit_message":"COMMIT_MESSAGES","squash_merge_commit_title":"COMMIT_OR_PR_TITLE","merge_commit_message":"PR_TITLE","merge_commit_title":"MERGE_MESSAGE","organization":{"login":"portato-io","id":127239963,"node_id":"O_kgDOB5WHGw","avatar_url":"https://avatars.githubusercontent.com/u/127239963?v=4","gravatar_id":"","url":"https://api.github.com/users/portato-io","html_url":"https://github.com/portato-io","followers_url":"https://api.github.com/users/portato-io/followers","following_url":"https://api.github.com/users/portato-io/following{/other_user}","gists_url":"https://api.github.com/users/portato-io/gists{/gist_id}","starred_url":"https://api.github.com/users/portato-io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/portato-io/subscriptions","organizations_url":"https://api.github.com/users/portato-io/orgs","repos_url":"https://api.github.com/users/portato-io/repos","events_url":"https://api.github.com/users/portato-io/events{/privacy}","received_events_url":"https://api.github.com/users/portato-io/received_events","type":"Organization","site_admin":false},"security_and_analysis":{"secret_scanning":{"status":"enabled"},"secret_scanning_push_protection":{"status":"disabled"},"dependabot_security_updates":{"status":"disabled"}},"network_count":0,"subscribers_count":0}
⠋ Retrieving a service account.[2023-07-25T14:14:31.001Z] >>> [apiv2][query] POST https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts [none]
[2023-07-25T14:14:31.001Z] >>> [apiv2][body] POST https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts {"accountId":"github-action-610901815","serviceAccount":{"displayName":"GitHub Actions (portato-io/portatoapp)","description":"A service account with permission to deploy to Firebase Hosting and Cloud Functions for the GitHub repository portato-io/portatoapp"}}
⠙ Retrieving a service account.[2023-07-25T14:14:31.949Z] <<< [apiv2][status] POST https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts 409
[2023-07-25T14:14:31.949Z] <<< [apiv2][body] POST https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts [omitted]
[2023-07-25T14:14:31.951Z] >>> [apiv2][query] GET https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts/[email protected] [none]
[2023-07-25T14:14:31.952Z] >>> [apiv2][query] POST https://cloudresourcemanager.googleapis.com/v1/projects/portatoapp:getIamPolicy [none]
⠸ Retrieving a service account.[2023-07-25T14:14:32.074Z] <<< [apiv2][status] GET https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts/[email protected] 200
[2023-07-25T14:14:32.074Z] <<< [apiv2][body] GET https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts/[email protected] {"name":"projects/portatoapp/serviceAccounts/[email protected]","projectId":"portatoapp","uniqueId":"111676116334481581313","email":"[email protected]","displayName":"GitHub Actions (portato-io/portatoapp)","etag":"MDEwMjE5MjA=","description":"A service account with permission to deploy to Firebase Hosting for the GitHub repository portato-io/portatoapp","oauth2ClientId":"111676116334481581313"}
⠹ Retrieving a service account.[2023-07-25T14:14:32.841Z] <<< [apiv2][status] POST https://cloudresourcemanager.googleapis.com/v1/projects/portatoapp:getIamPolicy 200
[2023-07-25T14:14:32.842Z] <<< [apiv2][body] POST https://cloudresourcemanager.googleapis.com/v1/projects/portatoapp:getIamPolicy {"version":1,"etag":"BwYBUFhycwI=","bindings":[{"role":"roles/artifactregistry.serviceAgent","members":["serviceAccount:service-22027928847@gcp-sa-artifactregistry.iam.gserviceaccount.com"]},{"role":"roles/cloudbuild.builds.builder","members":["serviceAccount:[email protected]"]},{"role":"roles/cloudbuild.serviceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/cloudfunctions.admin","members":["serviceAccount:[email protected]"]},{"role":"roles/cloudfunctions.developer","members":["serviceAccount:[email protected]"]},{"role":"roles/cloudfunctions.serviceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/containerregistry.ServiceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/editor","members":["serviceAccount:[email protected]"]},{"role":"roles/firebase.managementServiceAgent","members":["serviceAccount:firebase-service-account@firebase-sa-management.iam.gserviceaccount.com","serviceAccount:[email protected]"]},{"role":"roles/firebase.sdkAdminServiceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/firebaseauth.admin","members":["serviceAccount:[email protected]","serviceAccount:[email protected]"]},{"role":"roles/firebasedatabase.admin","members":["serviceAccount:[email protected]"]},{"role":"roles/firebasehosting.admin","members":["serviceAccount:[email protected]"]},{"role":"roles/firebaserules.system","members":["serviceAccount:[email protected]"]},{"role":"roles/firebasestorage.serviceAgent","members":["serviceAccount:service-22027928847@gcp-sa-firebasestorage.iam.gserviceaccount.com"]},{"role":"roles/firestore.serviceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/iam.serviceAccountTokenCreator","members":["serviceAccount:[email protected]"]},{"role":"roles/owner","members":["user:[email protected]","user:[email protected]","user:[email protected]","user:[email protected]"]},{"role":"roles/pubsub.serviceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/run.viewer","members":["serviceAccount:[email protected]"]},{"role":"roles/secretmanager.secretAccessor","members":["serviceAccount:[email protected]"]},{"role":"roles/serviceusage.apiKeysViewer","members":["serviceAccount:[email protected]"]},{"role":"roles/storage.admin","members":["serviceAccount:[email protected]"]}]}
[2023-07-25T14:14:32.843Z] >>> [apiv2][query] POST https://cloudresourcemanager.googleapis.com/v1/projects/portatoapp:setIamPolicy [none]
[2023-07-25T14:14:32.843Z] >>> [apiv2][body] POST https://cloudresourcemanager.googleapis.com/v1/projects/portatoapp:setIamPolicy {"policy":{"version":1,"etag":"BwYBUFhycwI=","bindings":[{"role":"roles/artifactregistry.serviceAgent","members":["serviceAccount:service-22027928847@gcp-sa-artifactregistry.iam.gserviceaccount.com"]},{"role":"roles/cloudbuild.builds.builder","members":["serviceAccount:[email protected]"]},{"role":"roles/cloudbuild.serviceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/cloudfunctions.admin","members":["serviceAccount:[email protected]"]},{"role":"roles/cloudfunctions.developer","members":["serviceAccount:[email protected]"]},{"role":"roles/cloudfunctions.serviceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/containerregistry.ServiceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/editor","members":["serviceAccount:[email protected]"]},{"role":"roles/firebase.managementServiceAgent","members":["serviceAccount:firebase-service-account@firebase-sa-management.iam.gserviceaccount.com","serviceAccount:[email protected]"]},{"role":"roles/firebase.sdkAdminServiceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/firebaseauth.admin","members":["serviceAccount:[email protected]","serviceAccount:[email protected]"]},{"role":"roles/firebasedatabase.admin","members":["serviceAccount:[email protected]"]},{"role":"roles/firebasehosting.admin","members":["serviceAccount:[email protected]"]},{"role":"roles/firebaserules.system","members":["serviceAccount:[email protected]"]},{"role":"roles/firebasestorage.serviceAgent","members":["serviceAccount:service-22027928847@gcp-sa-firebasestorage.iam.gserviceaccount.com"]},{"role":"roles/firestore.serviceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/iam.serviceAccountTokenCreator","members":["serviceAccount:[email protected]"]},{"role":"roles/owner","members":["user:[email protected]","user:[email protected]","user:[email protected]","user:[email protected]"]},{"role":"roles/pubsub.serviceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/run.viewer","members":["serviceAccount:[email protected]"]},{"role":"roles/secretmanager.secretAccessor","members":["serviceAccount:[email protected]"]},{"role":"roles/serviceusage.apiKeysViewer","members":["serviceAccount:[email protected]"]},{"role":"roles/storage.admin","members":["serviceAccount:[email protected]"]}]},"updateMask":"bindings"}
⠴ Retrieving a service account.[2023-07-25T14:14:33.867Z] <<< [apiv2][status] POST https://cloudresourcemanager.googleapis.com/v1/projects/portatoapp:setIamPolicy 200
[2023-07-25T14:14:33.867Z] <<< [apiv2][body] POST https://cloudresourcemanager.googleapis.com/v1/projects/portatoapp:setIamPolicy {"version":1,"etag":"BwYBUFm4BPE=","bindings":[{"role":"roles/artifactregistry.serviceAgent","members":["serviceAccount:service-22027928847@gcp-sa-artifactregistry.iam.gserviceaccount.com"]},{"role":"roles/cloudbuild.builds.builder","members":["serviceAccount:[email protected]"]},{"role":"roles/cloudbuild.serviceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/cloudfunctions.admin","members":["serviceAccount:[email protected]"]},{"role":"roles/cloudfunctions.developer","members":["serviceAccount:[email protected]"]},{"role":"roles/cloudfunctions.serviceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/containerregistry.ServiceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/editor","members":["serviceAccount:[email protected]"]},{"role":"roles/firebase.managementServiceAgent","members":["serviceAccount:firebase-service-account@firebase-sa-management.iam.gserviceaccount.com","serviceAccount:[email protected]"]},{"role":"roles/firebase.sdkAdminServiceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/firebaseauth.admin","members":["serviceAccount:[email protected]","serviceAccount:[email protected]"]},{"role":"roles/firebasedatabase.admin","members":["serviceAccount:[email protected]"]},{"role":"roles/firebasehosting.admin","members":["serviceAccount:[email protected]"]},{"role":"roles/firebaserules.system","members":["serviceAccount:[email protected]"]},{"role":"roles/firebasestorage.serviceAgent","members":["serviceAccount:service-22027928847@gcp-sa-firebasestorage.iam.gserviceaccount.com"]},{"role":"roles/firestore.serviceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/iam.serviceAccountTokenCreator","members":["serviceAccount:[email protected]"]},{"role":"roles/owner","members":["user:[email protected]","user:[email protected]","user:[email protected]","user:[email protected]"]},{"role":"roles/pubsub.serviceAgent","members":["serviceAccount:[email protected]"]},{"role":"roles/run.viewer","members":["serviceAccount:[email protected]"]},{"role":"roles/secretmanager.secretAccessor","members":["serviceAccount:[email protected]"]},{"role":"roles/serviceusage.apiKeysViewer","members":["serviceAccount:[email protected]"]},{"role":"roles/storage.admin","members":["serviceAccount:[email protected]"]}]}
[2023-07-25T14:14:33.868Z] >>> [apiv2][query] POST https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts/[email protected]/keys [none]
[2023-07-25T14:14:33.868Z] >>> [apiv2][body] POST https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts/[email protected]/keys {"keyAlgorithm":"KEY_ALG_UNSPECIFIED","privateKeyType":"TYPE_GOOGLE_CREDENTIALS_FILE"}
⠏ Retrieving a service account.[2023-07-25T14:14:34.167Z] <<< [apiv2][status] POST https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts/[email protected]/keys 400
[2023-07-25T14:14:34.168Z] <<< [apiv2][body] POST https://iam.googleapis.com/v1/projects/portatoapp/serviceAccounts/[email protected]/keys {"error":{"code":400,"message":"Precondition check failed.","status":"FAILED_PRECONDITION"}}

Error: HTTP Error: 400, Precondition check failed.
[2023-07-25T14:14:34.215Z] Error Context: {
"body": {
"error": {
"code": 400,
"message": "Precondition check failed.",
"status": "FAILED_PRECONDITION"
}
},
"response": {
"statusCode": 400
}
}

`

@google-oss-bot google-oss-bot added Needs: Attention and removed Needs: Author Feedback Issues awaiting author feedback labels Jul 25, 2023
@hugo2410
Copy link
Author

hugo2410 commented Jul 25, 2023

I have just updated to the latest version of firebase-tools : 12.4.5
and i'm still getting the same error

@aalej
Copy link
Contributor

aalej commented Jul 26, 2023

I’ve tried a couple of times to repro this, but so far I’m having no luck trying to replicate the issue. If you can provide any additional details on the steps you took, it is highly appreciated.

It seems like the process is failing when creating the service account key, I’m thinking it might be related to your project’s configuration or there may be an org policy in place that is preventing the creation of service account keys. Could you try manually creating a service account key to see if it’s an org policy issue?

It’s also possible that you may have hit the max limit of keys in a service account. As mentioned in this page, a service account can have up to 10 keys. If you’ve hit the limit, you could delete at least one of the old unused keys, which will allow you to generate a new one.

@aalej aalej added Needs: Author Feedback Issues awaiting author feedback and removed Needs: Attention labels Jul 26, 2023
@hugo2410
Copy link
Author

@aalej the issue was that the service account had indeed reached the maximum number of keys. Thanks for helping!

@hugo2410 hugo2410 changed the title Creation of Github Actions workflow fails Creation of Github Actions workflow fails due to max number of keys limit for service account Jul 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

4 participants