cloud-mu 3.5.0 → 3.6.3

data/modules/mu/providers/aws/vpc.rb

@@ -114,20 +114,6 @@ module MU
             raise MuError, "VPC endpoint failed #{endpoint_id}: #{resp}" if resp.state == "failed"
           end
 
-          if @config["enable_traffic_logging"]
-            loggroup = @deploy.findLitterMate(name: @config['name']+"loggroup", type: "logs")
-            logrole = @deploy.findLitterMate(name: @config['name']+"logrole", type: "roles")
-
-            MU.log "Enabling traffic logging on VPC #{@mu_name} to log group #{loggroup.mu_name}"
-            MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).create_flow_logs(
-              resource_ids: [@cloud_id],
-              resource_type: "VPC",
-              traffic_type: "ALL",
-              log_group_name: loggroup.mu_name,
-              deliver_logs_permission_arn: logrole.cloudobj.arn
-            )
-          end
-
           nat_gateways = create_subnets
 
           notify
@@ -270,6 +256,39 @@ module MU
             }
           end
 
+          if @config["enable_traffic_logging"]
+            ext = MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).describe_flow_logs(
+               filter: [
+                 { name: "resource-id", values: [@cloud_id] }
+               ]
+            )
+            # XXX a smarter guard would filter with more specificity
+            if !ext or ext.flow_logs.empty?
+              loggroup = if @config['log_group_name']
+                @config['log_group_name']
+              else
+                @deploy.findLitterMate(name: @config['name']+"loggroup", type: "logs").mu_name
+              end
+              logrole = @deploy.findLitterMate(name: @config['name']+"logrole", type: "roles")
+
+
+              MU.log "Enabling traffic logging on VPC #{@mu_name} to log group #{loggroup}"
+              MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).create_flow_logs(
+                resource_ids: [@cloud_id],
+                resource_type: "VPC",
+                traffic_type: "ALL",
+                log_group_name: loggroup,
+                deliver_logs_permission_arn: logrole.cloudobj.arn,
+                tag_specifications: [
+                  {
+                    resource_type: "vpc-flow-log",
+                    tags: @tags.each_key.map { |k| { :key => k, :value => @tags[k] } }
+                  }
+                ]
+              )
+            end
+          end
+
         end
 
         # Locate an existing VPC or VPCs and return an array containing matching AWS resource descriptors for those that match.
@@ -942,13 +961,15 @@ module MU
           ok = true
 
           if vpc["enable_traffic_logging"]
-            logdesc = {
-              "name" => vpc['name']+"loggroup",
-            }
-            logdesc["tags"] = vpc["tags"] if !vpc["tags"].nil?
-#            logdesc["optional_tags"] = vpc["optional_tags"] if !vpc["optional_tags"].nil?
-            configurator.insertKitten(logdesc, "logs")
-            MU::Config.addDependency(vpc, vpc['name']+"loggroup", "log")
+            if !vpc['log_group_name']
+              logdesc = {
+                "name" => vpc['name']+"loggroup",
+              }
+              logdesc["tags"] = vpc["tags"] if !vpc["tags"].nil?
+#              logdesc["optional_tags"] = vpc["optional_tags"] if !vpc["optional_tags"].nil?
+              configurator.insertKitten(logdesc, "logs")
+              MU::Config.addDependency(vpc, vpc['name']+"loggroup", "log")
+            end
 
             roledesc = {
               "name" => vpc['name']+"logrole",
@@ -971,20 +992,23 @@ module MU
                   "targets" => [
                     {
                       "type" => "log",
-                      "identifier" => vpc['name']+"loggroup"
+                      "identifier" => vpc['log_group_name'] ? vpc['log_group_name'] : vpc['name']+"loggroup"
                     }
                   ]
                 }
-              ],
-              "dependencies" => [
+              ]
+            }
+            if !vpc['log_group_name']
+              roledesc["dependencies"] = [
                 {
                   "type" => "log",
                   "name" => vpc['name']+"loggroup"
                 }
               ]
-            }
+            end
             roledesc["tags"] = vpc["tags"] if !vpc["tags"].nil?
             roledesc["optional_tags"] = vpc["optional_tags"] if !vpc["optional_tags"].nil?
+
             configurator.insertKitten(roledesc, "roles")
             MU::Config.addDependency(vpc, vpc['name']+"logrole", "role")
           end

data/modules/mu/providers/aws.rb

@@ -44,6 +44,12 @@ module MU
         [cfg['account_number']]
       end
 
+      # Cloud-specific resource methods or attributes we want exposed for
+      # reading by {MU::Cloud}
+      def self.customAttrReaders
+        [:region, :cloudformation_data]
+      end
+
       # A hook that is always called just before any of the instance method of
       # our resource implementations gets invoked, so that we can ensure that
       # repetitive setup tasks (like resolving +:resource_group+ for Azure
@@ -51,10 +57,6 @@ module MU
       # @param cloudobj [MU::Cloud]
       # @param _deploy [MU::MommaCat]
       def self.resourceInitHook(cloudobj, _deploy)
-        class << self
-          attr_reader :cloudformation_data
-          attr_reader :region
-        end
         return if !cloudobj
         cloudobj.instance_variable_set(:@cloudformation_data, {})
 
@@ -409,8 +411,10 @@ end
       end
 
       # Plant a Mu deploy secret into a storage bucket somewhere for so our kittens can consume it
-      # @param deploy_id [String]: The deploy for which we're writing the secret
+      # @param deploy [String]: The deploy for which we're writing the secret
       # @param value [String]: The contents of the secret
+      # @param name [String]: File/object name
+      # @param credentials [String]
       def self.writeDeploySecret(deploy, value, name = nil, credentials: nil)
         require "aws-sdk-s3"
         name ||= deploy.deploy_id+"-secret"
@@ -531,9 +535,9 @@ end
         if !@@is_in_aws.nil?
           return @@is_in_aws
         end
-
+start = Time.now
         begin
-          Timeout.timeout(4) do
+          Timeout.timeout(10) do
             instance_id = URI.open("http://169.254.169.254/latest/meta-data/instance-id").read
             if !instance_id.nil? and instance_id.size > 0
               @@is_in_aws = true
@@ -550,6 +554,7 @@ end
           end
         rescue OpenURI::HTTPError, Timeout::Error, SocketError, Errno::EHOSTUNREACH
         end
+MU.log "Fetch of http://169.254.169.254/latest/meta-data/instance-id took #{sprintf("%.2fs", Time.now-start)}", MU::WARN
 
         @@is_in_aws = false
         false
@@ -978,7 +983,7 @@ end
             id = matches.first
           elsif matches.size == 0
             if raise_on_missing
-              raise MuError, "No IAM or ACM certificate named #{name} was found in #{region}"
+              raise MuError, "No IAM or ACM certificate named #{name} was found in #{region} (credentials: #{(credentials.nil? or credentials.empty?) ? "default" : credentials})"
             else
               return nil
             end

data/modules/mu/providers/azure/container_cluster.rb

@@ -249,7 +249,7 @@ module MU
               os_obj = MU::Cloud::Azure.containers(:ContainerServiceWindowsProfile, model_version: "V2019_02_01").new
               os_obj.admin_username = "muadmin"
               # Azure password constraints are extra-annoying
-              winpass = MU.generateWindowsPassword(safe_pattern: '!@#$%^&*()', retries: 150)
+              winpass = MU.generatePassword(safe_pattern: '!@#$%^&*()', retries: 150)
 # TODO store this somewhere the user can get at it
               os_obj.admin_password = winpass
               os_obj

data/modules/mu/providers/azure/loadbalancer.rb

@@ -50,8 +50,8 @@ module MU
         # Register a Server node with an existing LoadBalancer.
         #
         # @param instance_id [String] A node to register.
-        # @param targetgroups [Array<String>] The target group(s) of which this node should be made a member. Not applicable to classic LoadBalancers. If not supplied, the node will be registered to all available target groups on this LoadBalancer.
-        def registerNode(instance_id, targetgroups: nil)
+        # @param backends [Array<String>] The target group(s) of which this node should be made a member. Not applicable to classic LoadBalancers. If not supplied, the node will be registered to all available target groups on this LoadBalancer.
+        def registerTarget(instance_id, backends: nil)
         end
 
         # Does this resource type exist as a global (cloud-wide) artifact, or

data/modules/mu/providers/azure/server.rb

@@ -426,7 +426,10 @@ MU.log "Azure::Server.find called", MU::NOTICE, details: args
         # @param size [String]: Size (in gb) of the new volume
         # @param type [String]: Cloud storage type of the volume, if applicable
         # @param delete_on_termination [Boolean]: Value of delete_on_termination flag to set
-        def addVolume(dev, size, type: "pd-standard", delete_on_termination: false)
+        def addVolume(dev: nil, size: 0, type: "pd-standard", delete_on_termination: false)
+          if dev.nil? or size == 0
+            raise MuError, "Must specify a device name and a size for addVolume"
+          end
         end
 
         # Determine whether the node in question exists at the Cloud provider
@@ -785,7 +788,7 @@ MU.log "Azure::Server.find called", MU::NOTICE, details: args
             os_obj.admin_password = begin
               @deploy.fetchSecret(@mu_name, "windows_admin_password")
             rescue MU::MommaCat::SecretError
-              pw = MU.generateWindowsPassword
+              pw = MU.generatePassword
               @deploy.saveNodeSecret(@mu_name, pw, "windows_admin_password")
               pw
             end

data/modules/mu/providers/azure/userdata/linux.erb

@@ -105,7 +105,7 @@ umask 0077
 
 # Install Chef now, because why not?
 if [ ! -f /opt/chef/embedded/bin/ruby ];then
-  curl https://www.chef.io/chef/install.sh > chef-install.sh
+  curl https://omnitruck.chef.io/install.sh > chef-install.sh
   set +e
   # We may run afoul of a synchronous bootstrap process doing the same thing. So
   # wait until we've managed to run successfully.

data/modules/mu/providers/azure.rb

@@ -52,6 +52,12 @@ module MU
         []
       end
 
+      # Cloud-specific resource methods or attributes we want exposed for
+      # reading by {MU::Cloud}
+      def self.customAttrReaders
+        [:region, :resource_group]
+      end
+
       # A hook that is always called just before any of the instance method of
       # our resource implementations gets invoked, so that we can ensure that
       # repetitive setup tasks (like resolving +:resource_group+ for Azure
@@ -59,9 +65,6 @@ module MU
       # @param cloudobj [MU::Cloud]
       # @param deploy [MU::MommaCat]
       def self.resourceInitHook(cloudobj, deploy)
-        class << self
-          attr_reader :resource_group
-        end
         return if !cloudobj
 
         rg = if !deploy
@@ -565,12 +568,12 @@ MU.log "vault existence check #{vaultname}", MU::WARN, details: resp
         return @@metadata if svc == "instance" and @@metadata
         base_url = "http://169.254.169.254/metadata/#{svc}"
         args["api-version"] = api_version
-        arg_str = args.keys.map { |k| k.to_s+"="+args[k].to_s }.join("&")
+        arg_str = args.keys.sort.map { |k| k.to_s+"="+CGI.escape(args[k].to_s) }.join("&")
 
         begin
           Timeout.timeout(2) do
-            resp = JSON.parse(URI.open("#{base_url}/?#{arg_str}","Metadata"=>"true").read)
-            MU.log "curl -H Metadata:true "+"#{base_url}/?#{arg_str}", loglevel, details: resp
+            resp = JSON.parse(URI.open("#{base_url}?#{arg_str}","Metadata"=>"true").read)
+            MU.log "curl -H Metadata:true "+"#{base_url}?#{arg_str}", loglevel, details: resp
             if svc != "instance"
               return resp
             else
@@ -597,9 +600,9 @@ MU.log "vault existence check #{vaultname}", MU::WARN, details: resp
         cfg = credConfig(credentials)
 
         if cfg and MU::Cloud::Azure.hosted?
-          token = MU::Cloud::Azure.get_metadata("identity/oauth2/token", "2018-02-01", args: { "resource"=>"https://management.azure.com/" })
+          token = MU::Cloud::Azure.get_metadata("identity/oauth2/token", "2020-09-01", args: { "resource"=>"https://management.azure.com/" })
           if !token
-            MU::Cloud::Azure.get_metadata("identity/oauth2/token", "2018-02-01", args: { "resource"=>"https://management.azure.com/" }, debug: true)
+            MU::Cloud::Azure.get_metadata("identity/oauth2/token", "2020-09-01", args: { "resource"=>"https://management.azure.com/" }, debug: true)
             raise MuError, "Failed to get machine oauth token"
           end
           machine = MU::Cloud::Azure.get_metadata

data/modules/mu/providers/cloudformation/dnszone.rb

@@ -248,7 +248,7 @@ module MU
         end
         # Placeholder. This is a NOOP for CloudFormation, which doesn't build
         # resources directly.
-        def self.genericMuDNSEntry(*args)
+        def self.genericMuDNSEntry(**args)
           MU.log "find() not implemented for CloudFormation layer", MU::DEBUG
           nil
         end

data/modules/mu/providers/google/container_cluster.rb

@@ -95,7 +95,7 @@ module MU
           desc = {
             :name => @mu_name.downcase,
             :description => @deploy.deploy_id,
-            :network => @vpc.cloud_id,
+            :network => @vpc.url,
             :enable_tpu => @config['tpu'],
             :resource_labels => labels,
             :locations => locations,
@@ -108,6 +108,7 @@ module MU
             ),
           }
 
+
           if @config['kubernetes']
             desc[:addons_config] = MU::Cloud::Google.container(:AddonsConfig).new(
               horizontal_pod_autoscaling: MU::Cloud::Google.container(:HorizontalPodAutoscaling).new(
@@ -135,6 +136,8 @@ module MU
               end
             }
           end
+
+
           if @config['log_facility'] == "kubernetes"
             desc[:logging_service] = "logging.googleapis.com/kubernetes"
             desc[:monitoring_service] = "monitoring.googleapis.com/kubernetes"
@@ -183,6 +186,7 @@ module MU
             )
           end
 
+
           if @config['ip_aliases'] or @config['custom_subnet'] or
              @config['services_ip_block'] or @config['services_ip_block_name'] or
              @config['pod_ip_block'] or @config['pod_ip_block_name'] or
@@ -210,17 +214,26 @@ module MU
             end
 
             if @config['services_ip_block']
+              if @vpc.project_id != @project_id
+                alloc_desc[:services_secondary_range_name] ||= @config['name']+"-services"
+                @vpc.addSecondaryRange(desc[:subnetwork], @config['services_ip_block'], alloc_desc[:services_secondary_range_name])
+
+              end
               alloc_desc[:services_ipv4_cidr_block] = @config['services_ip_block']
             end
             if @config['tpu_ip_block']
               alloc_desc[:tpu_ipv4_cidr_block] = @config['tpu_ip_block']
             end
             if @config['pod_ip_block']
+              if @vpc.project_id != @project_id
+                alloc_desc[:cluster_secondary_range_name] ||= @config['name']+"-pods"
+                @vpc.addSecondaryRange(desc[:subnetwork], @config['pod_ip_block'], alloc_desc[:cluster_secondary_range_name])
+
+              end
               alloc_desc[:cluster_ipv4_cidr_block] = @config['pod_ip_block']
             end
 
             desc[:ip_allocation_policy] = MU::Cloud::Google.container(:IpAllocationPolicy).new(alloc_desc)
-            pp alloc_desc
           end
 
           if @config['authorized_networks'] and @config['authorized_networks'].size > 0

data/modules/mu/providers/google/folder.rb

@@ -260,7 +260,8 @@ module MU
             args[:flags]['parent_id']
           else
             my_org = MU::Cloud::Google.getOrg(args[:credentials])
-            my_org.name
+# XXX re-raise with a clear permission error
+            my_org.name if my_org
           end
 
           if args[:cloud_id]

data/modules/mu/providers/google/function.rb

@@ -120,7 +120,7 @@ module example.com/cloudfunction
         def groom
           desc = {}
 
-          func_obj = buildDesc
+          func_obj = buildDesc(true)
 
           labels = Hash[@tags.keys.map { |k|
             [k.downcase, @tags[k].downcase.gsub(/[^-_a-z0-9]/, '-')] }
@@ -161,6 +161,13 @@ module example.com/cloudfunction
                cloud_desc.event_trigger.resource != @config['triggers'].first['resource']
               need_update = true
             end
+          elsif !cloud_desc.https_trigger
+            need_update = true
+          end
+
+          if (@config['internal_only'] and cloud_desc.ingress_settings != "ALLOW_INTERNAL_ONLY") or
+             (!@config['internal_only'] and cloud_desc.ingress_settings != "ALLOW_ALL")
+            need_update = true
           end
 
           current = Dir.mktmpdir(@mu_name+"-current") { |dir|
@@ -206,6 +213,7 @@ module example.com/cloudfunction
           end
 
           if need_update
+            MU::Cloud::Google::Function.uploadPackage(@config['code']['zip_file'], @mu_name+"-cloudfunction.zip", credentials: @credentials)
             MU.log "Updating Cloud Function #{@cloud_id}", MU::NOTICE, details: func_obj
             begin
               MU::Cloud::Google.function(credentials: @credentials).patch_project_location_function(
@@ -235,6 +243,71 @@ module example.com/cloudfunction
             tempfile.unlink
           end
 
+          policy = MU::Cloud::Google.function(credentials: @credentials).get_project_location_function_iam_policy(@cloud_id)
+
+          if @config['allow_unauthenticated'] and !allowsUnauthencated?
+            policy ||= MU::Cloud::Google.function(:Policy).new(
+              bindings: []
+            )
+            policy.bindings ||= []
+            policy.bindings << MU::Cloud::Google.function(:Binding).new(
+              members: ["allUsers"],
+              role: "roles/cloudfunctions.invoker"
+            )
+
+            pol_req = MU::Cloud::Google.function(:SetIamPolicyRequest).new(
+              policy: policy
+            )
+            MU.log "Enabling anonymous invocation of Cloud Function #{@mu_name}", MU::NOTICE
+            MU::Cloud::Google.function(credentials: @credentials).set_function_iam_policy(@cloud_id, pol_req)
+          elsif !@config['allow_unauthenticated'] and allowsUnauthencated?
+            policy.bindings.reject! { |b|
+              b.members.include?("allUsers") and b.role == "roles/cloudfunctions.invoker"
+            }
+            pol_req = MU::Cloud::Google.function(:SetIamPolicyRequest).new(
+              policy: policy
+            )
+            MU.log "Disabling anonymous invocation of Cloud Function #{@mu_name}", MU::NOTICE
+            MU::Cloud::Google.function(credentials: @credentials).set_function_iam_policy(@cloud_id, pol_req)
+          end
+
+          # If we have a loadbalancer configured, attach us to it
+          if !@config['loadbalancers'].nil?
+            if @loadbalancers.nil?
+              raise MuError, "#{@mu_name} is configured to use LoadBalancers, but none have been loaded by dependencies()"
+            end
+
+            neg_name = @deploy.getResourceName(@config["name"], max_length: 19, never_gen_unique: true).downcase
+            neg_desc = begin
+              MU::Cloud::Google.compute(credentials: @config['credentials']).get_region_network_endpoint_group(@project_id, @config['region'], neg_name)
+            rescue ::Google::Apis::ClientError => e
+              raise e if e.message !~ /notFound:/
+              neg_obj = MU::Cloud::Google.compute(:NetworkEndpointGroup).new(
+                name: neg_name,
+                description: @deploy.deploy_id,
+                cloud_function: MU::Cloud::Google.compute(:NetworkEndpointGroupCloudFunction).new(
+                  function: @cloud_id.gsub(/.*?\//, '')
+                ),
+                network_endpoint_type: "SERVERLESS"
+              )
+              MU.log "Creating Network Endpoint Group #{neg_name}", details: neg_obj
+              MU::Cloud::Google.compute(credentials: @config['credentials']).insert_region_network_endpoint_group(@project_id, @config['region'], neg_obj)
+              retry
+            end
+
+            @loadbalancers.each { |lb|
+#              if !lb.targetgroups
+#                MU.retrier([], max: 6, wait: 15, loop_if: Proc.new { !lb.targetgroups }) {
+#                  lb.cloud_desc(use_cache: false)
+#                }
+#              end
+#              lb.targetgroups.each_pair { |tg_name, tg|
+#                addTrigger(tg.target_group_arn, "elasticloadbalancing", tg_name)
+#              }
+              lb.registerTarget(neg_desc.self_link)
+            }
+          end
+
         end
 
         # Return the metadata for this project's configuration
@@ -330,6 +403,12 @@ module example.com/cloudfunction
           bok["handler"] = cloud_desc.entry_point
           bok["timeout"] = cloud_desc.timeout.gsub(/[^\d]/, '').to_i
 
+          if cloud_desc.ingress_settings and cloud_desc.ingress_settings == "ALLOW_INTERNAL_ONLY"
+            bok['internal_only'] = true
+          else
+            bok['internal_only'] = false
+          end
+
           if cloud_desc.vpc_connector
             bok["vpc_connector"] = cloud_desc.vpc_connector
           elsif cloud_desc.network
@@ -350,7 +429,7 @@ module example.com/cloudfunction
               type: "vpcs"
             )
           end
-
+          
           if cloud_desc.environment_variables and cloud_desc.environment_variables.size > 0
             bok['environment_variable'] = cloud_desc.environment_variables.keys.map { |k| { "key" => k, "value" => cloud_desc.environment_variables[k] } }
           end
@@ -373,6 +452,9 @@ module example.com/cloudfunction
             'zip_file' => codefile
           }
 
+
+          bok['allow_unauthenticated'] = allowsUnauthencated?
+
           bok
         end
 
@@ -411,6 +493,16 @@ module example.com/cloudfunction
               "type" => "string",
               "description" => "+DEPRECATED+ VPC Connector to attach, of the form +projects/my-project/locations/some-region/connectors/my-connector+. This option will be removed once proper google-cloud-sdk support for VPC Connectors becomes available, at which point we will piggyback on the normal +vpc+ stanza and resolve connectors as needed."
             },
+            "allow_unauthenticated" => {
+              "type" => "boolean",
+              "default" => false,
+              "description" => "Only applicable for HTTPS-triggered functions; allows function invocation without credentials"
+            },
+            "internal_only" => {
+              "type" => "boolean",
+              "default" => false,
+              "description" => "Permit only traffic from VPC networks in the same project or VPC SC perimeter"
+            },
             "vpc_connector_allow_all_egress" => {
               "type" => "boolean",
               "default" => false,
@@ -473,11 +565,13 @@ module example.com/cloudfunction
         # @return [String]: The Cloud Storage URL to the result
         def self.uploadPackage(zipfile, filename, credentials: nil)
           bucket = MU::Cloud::Google.adminBucketName(credentials)
+
           obj_obj = MU::Cloud::Google.storage(:Object).new(
             content_type: "application/zip",
             name: filename
           )
 
+          MU.log "Uploading #{zipfile} to #{bucket}/#{filename}"
           MU::Cloud::Google.storage(credentials: credentials).insert_object(
             bucket,
             obj_obj,
@@ -574,12 +668,33 @@ module example.com/cloudfunction
 #            ok = false
 #          end
 
+          if !function["loadbalancers"].nil?
+            function["loadbalancers"].each { |lb|
+              lb["name"] ||= lb["concurrent_load_balancer"]
+              if lb["name"]
+                MU::Config.addDependency(function, lb["name"], "loadbalancer")
+              end
+            }
+          end
+
           ok
         end
 
         private
 
-        def buildDesc
+        def allowsUnauthencated?
+          policy = MU::Cloud::Google.function(credentials: @credentials).get_project_location_function_iam_policy(@cloud_id)
+          if policy and policy.bindings
+            policy.bindings.each { |b|
+              if b.members.include?("allUsers") and b.role == "roles/cloudfunctions.invoker"
+                return true
+              end
+            }
+          end
+          false
+        end
+
+        def buildDesc(no_upload = false)
           labels = Hash[@tags.keys.map { |k|
             [k.downcase, @tags[k].downcase.gsub(/[^-_a-z0-9]/, '-')] }
           ]
@@ -631,6 +746,12 @@ module example.com/cloudfunction
             desc[:https_trigger] = MU::Cloud::Google.function(:HttpsTrigger).new
           end
 
+          if @config["internal_only"]
+            desc[:ingress_settings] = "ALLOW_INTERNAL_ONLY"
+          else
+            desc[:ingress_settings] = "ALLOW_ALL"
+          end
+
 
           if @config['environment_variable']
             @config['environment_variable'].each { |var|
@@ -658,7 +779,12 @@ module example.com/cloudfunction
             else
               MU.log "#{@mu_name} using code packaged at #{@config['code']['zip_file']}"
             end
-            desc[:source_archive_url] = MU::Cloud::Google::Function.uploadPackage(@config['code']['zip_file'], @mu_name+"-cloudfunction.zip", credentials: @credentials)
+            bucket = MU::Cloud::Google.adminBucketName(credentials)
+
+            desc[:source_archive_url] = "gs://#{bucket}/#{@mu_name}-cloudfunction.zip"
+            if !no_upload
+              MU::Cloud::Google::Function.uploadPackage(@config['code']['zip_file'], @mu_name+"-cloudfunction.zip", credentials: @credentials)
+            end
 
             if tempfile
               tempfile.close

data/modules/mu/providers/google/habitat.rb

@@ -303,7 +303,8 @@ module MU
           bok['name'] = cloud_desc.project_id
           bok['cloud_id'] = cloud_desc.project_id
 #          if cloud_desc.name != cloud_desc.project_id
-            bok['display_name'] = cloud_desc.name
+          bok['display_name'] = cloud_desc.name
+          bok['display_name'] ||= ""
 #          end
 
           if cloud_desc.parent and cloud_desc.parent.id