IssueTracker

Problem you have encountered:

We use gcloud dataflow flex-template build to build our flex templates from a Cloud Build script. After the recent suggestion, we stopped using the legacy Cloud Build service account.

However, the CLI does not support the usage of another service account. When we execute the following command inside our Cloud Build script:

        gcloud dataflow flex-template build gs://path/to/template.json \
        --image-gcr-path artifact-registry/group/image:latest \
        --sdk-language JAVA \
        --flex-template-base-image JAVA17 \
        --metadata-file metadata.json \
        --jar target/project-1.0.0.jar \
        --env FLEX_TEMPLATE_JAVA_MAIN_CLASS=com.company.MainClass \
        --project myproject
        --service-account-email 123456789-compute@developer.gserviceaccount.com

an additional build is created for the docker image, which uses the legacy service account (PROJECT_NUMBER@cloudbuild.gserviceaccount.com). As a result, the build fails because it does not have the necessary permissions.

What you expected to happen:

The build to be created using the provided service account.

Steps to reproduce:

Define and execute a simple Cloud Build which builds a flex template:

steps:
  - name: 'maven:3.9.5-amazoncorretto-17'
    args:
      - '-c'
      - |
        mvn clean package
    entrypoint: bash
  - name: gcr.io/google.com/cloudsdktool/cloud-sdk
    args:
      - '-eEuo'
      - 'pipefail'
      - '-c'
      - |-
        gcloud dataflow flex-template build gs://path/to/template.json \
        --image-gcr-path artifact-registry/group/image:latest \
        --sdk-language JAVA \
        --flex-template-base-image JAVA17 \
        --metadata-file metadata.json \
        --jar target/project-1.0.0.jar \
        --env FLEX_TEMPLATE_JAVA_MAIN_CLASS=com.company.MainClass \
        --project myproject
    entrypoint: bash

Other information (workarounds you have tried, documentation consulted, etc):

We also tried other flags from the CLI documentation:

• --impersonate-service-account
• --account

Looking at the CLI code, it looks like the build is created without providing any service account:

      build_config = submit_util.CreateBuildConfig(
          image_gcr_path,
          no_cache=False,
          messages=messages,
          substitutions=None,
          arg_config='cloudbuild.yaml',
          is_specified_source=True,
          no_source=False,
          source=temp_dir,
          gcs_source_staging_dir=None,
          ignore_file=None,
          arg_gcs_log_dir=gcs_log_dir,
          arg_machine_type=None,
          arg_disk_size=None,
          arg_worker_pool=None,
          arg_dir=None,
          arg_revision=None,
          arg_git_source_dir=None,
          arg_git_source_revision=None,
          arg_service_account=None,     <--- no service account provided
          buildpack=None,
      )