Gcloud builds submit fails on "global" violates constraint "constraints/gcp.resourceLocations"

Question

I am working a lot with the Google Cloud Platform. Last year, we instated the resource constraint policy "constraints/gcp.resourceLocations" to Europe only. As of today, we are seeing a lot of strange errors when submitting a cloud build. Does anyone know if Google recently changed something in their Cloud Build service and make it regional?

The following command used to work:

gcloud builds submit .

However, overnight (12 november 2020), we got the following error:

ERROR: (gcloud.builds.submit) FAILED_PRECONDITION: "global" violates constraint "constraints/gcp.resourceLocations" on the resource "projects/[PROJECT_ID]/locations/global/builds/[UUID]"

• '@type': type.googleapis.com/google.rpc.PreconditionFailure violations:
  • description: '"global" violates constraint "constraints/gcp.resourceLocations"

When running the following command:

gcloud builds submit . --region=europe-west1

The following error appears:

ERROR: (gcloud.builds.submit) User [USER] does not have permission to access projects instance [PROJECT_ID] (or it may not exist): project is not on the allowlist for Regional Cloud Build, please contact [email protected]

Mizzle

Great question and no answer... Did you contact the provided email? There is lot of change in Cloud Build in preparation, and I guess the regionalization is one of these. – Langham

Hoped someone else would find this post! We decided to turn off the policy for now, since it concerns the production infrastructure as well. The provided e-mail is shut down for some reason, so we are going to contact support directly. I will update if we have a resolution. – Mizzle

Great! In our company, we have a test organisation where we try Organisation policy, because sometime, there is side effect like this... Anyway, the answer of Google support will be interesting. Keep us posted! – Langham

Yes, we have the same procedure, we always test on a separate folder, which holds all the development projects. But this was an unintended side effect from Google, for which I saw no announcement. We had a similar issue before where project default buckets were in another region than the policy prescribed, which caused cloud build to break. – Mizzle

Answer 1

That was an internal issue on the GCP side, which has been fixed shortly by the Cloud Build engineering team.

Revareval

Do you have a source/url verifying your statement? – Mizzle

@Nebulastic Could you please confirm if the issue has been resolved on your side as well? – Audient

Still the same issue. I had some hopes when I specified --region=europe. It then said: Try one of [asia-east1, asia-southeast1, europe-west1, europe-west4, us-central1, us-east1]. – Mizzle

Hello, this might be because the Europe regions are further specified as documented here and thus the command --region=europe will not work. Please correct me if I misunderstood anything. – Audient

Answer 2

I had a similar issue. Where the issue i was facing was "'us' violates constraint ‘constraints/gcp.resourceLocations’"

Thanks to @Cloudkollektiv's answer. I was able to get a fix and understand underlying cause of this issue. i.e clud build fails to create a resource in a particular region due to ‘constraints/gcp.resourceLocations' but the error message is different that the actual error

I strongly fee that google needs to provide more accurate error responses

I hope this answer in future will helps people in understanding the issue.

Eslinger