GCP Functions gen2 "You must assign the Invoker role"

I want to deploy a cloud function that can be called by everyone via http.

This is my deploy script:

gcloud functions deploy <MYFUNCTION> --runtime nodejs18 --gen2 --trigger-http --region=europe-west1 --allow-unauthenticated --project=<MYPROJECT> --set-env-vars NODE_ENV=production

But I get this warning:

> Warning: You must assign the Invoker role (roles/run.invoker) through
> Cloud Run for 2nd gen functions if you want to allow the function to
> receive requests from additional principals or other given authorities
> in IAM. Note: if you want to achieve the equivalent of assigning the
> Cloud Functions "Admin" or "Developer" role to a 1st gen function, you
> need to assign Cloud Functions "Admin" or "Developer" to the 2nd gen
> function and assign "Cloud Run Invoker" to the Cloud Run service.

What am I doing wrong?

Note, I am new to GCP and IAM.

As per Authenticating for invocation;

> The user account you are using to access Cloud Functions assigned a
> role that contains the cloudfunctions.functions.invoke permission.
> By default, the Cloud Functions Admin and
> Developer roles have this permission.
>
> You need to grant the appropriate invoker role to the calling
> function's service account on the receiving function.
>
> Cloud Functions (1st gen): Run the below command for 1st gen
> functions, the invoker role is Cloud Functions Invoker
> (roles/cloudfunctions.invoker)
>
> gcloud functions add-iam-policy-binding RECEIVING_FUNCTION
> --member='serviceAccount:CALLING_FUNCTION_IDENTITY'
> --role='roles/cloudfunctions.invoker'
>
> Cloud Functions (2nd gen): Run the below command for 2nd gen functions, the invoker
> role is Cloud Run Invoker (roles/run.invoker) and must be granted on
> the underlying service.
>
> gcloud functions add-invoker-policy-binding RECEIVING_FUNCTION
> --member='serviceAccount:CALLING_FUNCTION_IDENTITY'
>
> where RECEIVING_FUNCTION is the name of the receiving function and
> CALLING_FUNCTION_IDENTITY is the calling function identity, a service
> account email.

Also refer to IAM Control access on an individual service for more details.

> You can make a service publicly accessible by adding the special
> allUsers member type to a service and granting it the
> roles/run.invoker role:
>
> gcloud run services add-iam-policy-binding [SERVICE_NAME]
> --member="allUsers"
> --role="roles/run.invoker"
>Additionally, when you deploy your service with the gcloud run deploy command, you can specify whether or
> not to make your service publicly accessible:
>
> gcloud run deploy [SERVICE_NAME] ... --allow-unauthenticated