We fixed it by using an owner account. We gave another account the owner role. The service accounts were automagically created with the correct roles and permissions this way on deploying the cloud functions.