Cloud Build fails with resource location constraint - google-cloud-platform

Question

We have a policy in place which restricts resources to EU regions.
When I try to execute a cloud build, gcloud wants to create a bucket (gs://[PROJECT_ID]_cloudbuild) to store staging sources. This step fails, because the default bucket location ('us') is used:
"code": 412,
"message": "'us' violates constraint ‘constraints/gcp.resourceLocations’"
As a workaround I tried to pass an existing bucket located in a valid region (using --gcs-source-staging-dir), but I got the same error.
How can this be solved?
Here the HTTP logs:
$ gcloud --log-http builds submit --gcs-source-staging-dir gs://my-custom-bucket/staging \
--tag gcr.io/xxxxxxxxxx/quickstart-image .
=======================
==== request start ====
uri: https://www.googleapis.com/storage/v1/b?project=xxxxxxxxxx&alt=json
method: POST
== headers start ==
accept: application/json
content-type: application/json
== headers end ==
== body start ==
{"name": "my-custom-bucket"}
== body end ==
==== request end ====
---- response start ----
-- headers start --
server: UploadServer
status: 412
-- headers end --
-- body start --
{
"error": {
"errors": [
{
"domain": "global",
"reason": "conditionNotMet",
"message": "'us' violates constraint ‘constraints/gcp.resourceLocations’",
"locationType": "header",
"location": "If-Match"
}
],
"code": 412,
"message": "'us' violates constraint ‘constraints/gcp.resourceLocations’"
}
}
-- body end --
---- response end ----
----------------------
ERROR: (gcloud.builds.submit) HTTPError 412: 'us' violates constraint ‘constraints/gcp.resourceLocations’

Answer 1

I found the solution to this problem. After you create the project (with resource location restriction enabled), you should create a new bucket with the name [PROJECT_ID]_cloudbuild in the preferred location.
When you don't do this, cloud build submit will automatically create a bucket in the US, this is not configurable. And because of the resource restrictions, cloud build is not able to create this bucket in the US and this fails with the following error:
ERROR: (gcloud.builds.submit) HTTPError 412: 'us' violates constraint 'constraints/gcp.resourceLocations'
When you create the bucket (by hand) with the same name, cloudbuild will take that bucket as default bucket. The solution was not immediately visible, because for projects that already had the cloudbuild bucket in place when the resource restrictions were applied, the problem did not appear.

Answer 2

Cloud Build will use a default bucket to store logs. You can try to add logsBucket field to the build config file with a specific bucket like in the snippet:
steps:
- name: 'gcr.io/cloud-builders/go'
args: ['install', '.']
logsBucket: 'gs://mybucket'
You can find detailed information about the build configuration file here

Answer 3

I had this issue investigated by Google Support. They came up with the following answer:
After investigating with the different teams involved in this issue,
it seems like the restrictions affecting Cloud Build (in this case,
preventing resource allocation in US) is intended. The only workaround
that came up from the investigation was the creation of a new project
without the restrictions in place that allows the use of Cloud Build.
They also referred to a feature request (already mentioned by in #Christopher P 's comment - thanks for that)

Answer 4

I faced the same issue with location constraints , follow the below steps to fix it
After logging to gcp console, select the required project where you are facing the issue
Then choose "Organization policies" from the IAM console. Make sure you have the necessary permissions for it to get listed
Look for the policy "Google Cloud Platform - Resource Location Restriction" policy in the list. Typically it comes under the category of custom policy
Please refer the this screenshot:
location constraint
Click on the policy, click on edit, drag down in custom values add the location which you want.
using prefix in means it includes everything to mention specific value use location name with out prefix
here " 'us' violates constraint ‘constraints/gcp.resourceLocations"
Enter value us in the custom value add it and save , if it requires all zone in us-east mention prefix in like this
in:us-east4-locations
hope this works
allowed values