19

I cannot find way how to deploy firebase project (functions) on behalf of service account.

Nothing is said both on documentation page and also I found nothing related in their bug tracker.

As described, I run firebase login:ci command but then I need to login myself - and I want login as service account.

Such feature is available using gcloud tool, but, as stated in docs,

Cloud Functions written using the Firebase SDK for Cloud Functions can't be deployed using the gcloud command-line tool, and vice-versa.

2
  • Since the documentation explicitly says that this isn't possible, what is your question? Aug 1, 2017 at 13:52
  • Documentation says that it is impossible use gcloud tool to deploy cloud functions written using firebase SDK. It doesn't say that deployment using firebase-tools on behalf of service account is impossible. I hope there should be some way
    – Serge
    Aug 1, 2017 at 14:24

3 Answers 3

18

firebaser here

Since version 7.1 of the Firebase CLI/tools it is possible to authenticate with a service account.

Also see Michael's answer here: Login to firebase using gcloud service account

Previous answer:

To use the Firebase CLI/tools you need to be signed in as an actual user. There is no way to run the Firebase CLI as a service account.

It's been noted as a valid and interesting feature request though! Some work that might help towards this feature is being done in this PR. As usual: no commits on if/when/how this may land. Keep an eye on the release notes for the latest updates.

10
  • 3
    It would be a useful feature. We'd like to have our CI automatically deploy to firebase (hosting and functions) after successful builds and a service account seems like the sensible way to do that.
    – El Yobo
    Feb 8, 2018 at 22:33
  • 1
    Looks like this is merged. Aug 27, 2018 at 17:36
  • 1
    It seems something is happening there ... github.com/firebase/firebase-tools/issues/787 Hopefully we'll have working GOOGLE_APPLICATION_CREDENTIALS method soon :) Jan 9, 2019 at 7:32
  • 1
    I've tested the new Firebase CLI v7.1.0 with a service account and it works like a charm now: github.com/firebase/firebase-tools/releases/tag/v7.1.0
    – Ani
    Jul 16, 2019 at 20:45
  • 2
    @Dapp Yes, it works without needing a browser sign in step. Since v7.1.0 we are able to use Firebase CLI to deploy Firestore and Storage rules as build-steps in CI/CD pipeline just using the default service account of Cloud Build (basically just like we use gcloud, bq, or gsutil there). But same should work also on Gitlab, Bitbucket CI etc with credentials of a custom service account.
    – Ani
    Oct 7, 2019 at 7:17
7

This works:

$> gcloud iam service-accounts keys create ./secrets.json --iam-account=<SERVICE_ACCOUNT_EMAIL>

$> export GOOGLE_APPLICATION_CREDENTIALS="./secrets.json"

$> firebase deploy --project <PROJECT_ID>
4

You can actually use the refresh token of a Google account (service account or otherwise) that has access to Firebase roles, and set it to the FIREBASE_TOKEN environment variable.

For example I use Cloud Build (which has an associated service account that is already logged into gcloud) and then set FIREBASE_TOKEN to the output of gcloud auth application-default print-access-token.

3
  • 1
    Thanks for that suggested solution. Based on that I created a dedicated build step which I simply wanted to share for others looking into it: - name: 'gcr.io/cloud-builders/gcloud' entrypoint: /bin/bash args: ['-c', 'gcloud auth application-default print-access-token > FIREBASE_TOKEN']
    – Alx
    Oct 24, 2019 at 15:20
  • @thoutbeckers "service account or otherwise"- how can I obtain refresh token of a service account?
    – AsifM
    Nov 19, 2019 at 13:38
  • In my case the service account is already the set account, but in the past I've used the --impersonate-service-account=SERVICE_ACCOUNT_EMAIL flag with gcloud for other things. Make sure your the role of your own account is high enough (it needs the iam.serviceAccounts.getAccessToken permission). If it works you can let me know here and I'll update the answer. Nov 20, 2019 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.