GoogleContainerTools/skaffold · error

DEPLOY_CLOUD_RUN_GET_SERVICE_ERR

DEPLOY_CLOUD_RUN_GET_SERVICE_ERR

Error message

error checking Cloud Run State: %w

What it means

To decide between creating and replacing a service, `deployService` calls the Cloud Run API `Projects.Locations.Services.Get(sName)`. If the call fails with anything other than a googleapi 404 (which would mean 'new service, create it'), the error is wrapped as 'error checking Cloud Run State: %w' with code DEPLOY_CLOUD_RUN_GET_SERVICE_ERR.

Source

Thrown at pkg/skaffold/deploy/cloudrun/deploy.go:294

		}
	}
	resName := RunResourceName{
		Project: service.Metadata.Namespace,
		Region:  d.Region,
		Service: service.Metadata.Name,
	}
	output.Default.Fprintln(out, "Deploying Cloud Run service:\n\t", service.Metadata.Name)
	parent := fmt.Sprintf("projects/%s/locations/%s", service.Metadata.Namespace, d.Region)

	sName := resName.String()
	d.logger.AddResource(resName)
	getCall := crclient.Projects.Locations.Services.Get(sName)
	_, err := getCall.Do()

	if err != nil {
		gErr, ok := err.(*googleapi.Error)
		if !ok || gErr.Code != http.StatusNotFound {
			return nil, sErrors.NewError(fmt.Errorf("error checking Cloud Run State: %w", err), &proto.ActionableErr{
				Message: err.Error(),
				ErrCode: proto.StatusCode_DEPLOY_CLOUD_RUN_GET_SERVICE_ERR,
			})
		}
		// This is a new service, we need to create it
		createCall := crclient.Projects.Locations.Services.Create(parent, service)
		_, err = createCall.Do()
	} else {
		replaceCall := crclient.Projects.Locations.Services.ReplaceService(sName, service)
		_, err = replaceCall.Do()
	}
	if err != nil {
		return nil, sErrors.NewError(fmt.Errorf("error deploying Cloud Run Service: %s", err), &proto.ActionableErr{
			Message: err.Error(),
			ErrCode: proto.StatusCode_DEPLOY_CLOUD_RUN_UPDATE_SERVICE_ERR,
		})
	}
	return &resName, nil

View on GitHub (pinned to a1189de023)

Solutions

1. Check the wrapped error's HTTP code: enable the Cloud Run API (`gcloud services enable run.googleapis.com`) if the API is disabled
2. Fix permissions: grant the caller `roles/run.admin` or at least run.services.get on the project
3. Re-authenticate (`gcloud auth application-default login`) if the code is 401
4. Verify the configured region matches where the service lives; test with `gcloud run services describe <name> --region <region>`
5. Check network/proxy connectivity to run.googleapis.com if the error is a transport error

Example fix

# before: 403 permission denied
gcloud projects add-iam-policy-binding my-project \
  --member=serviceAccount:ci@my-project.iam.gserviceaccount.com \
  --role=roles/run.admin
# then re-run skaffold deploy

func preflightCloudRunAccess(project, region string) error {
	cmd := exec.Command("gcloud", "run", "services", "list", "--project", project, "--region", region, "--limit", "1")
	cmd.Stderr = os.Stderr
	return cmd.Run() // fails early on 403/401/network/API-not-enabled
}

if err := deployer.Deploy(ctx, out, artifacts); err != nil {
	var sErr *sErrors.Error
	if errors.As(err, &sErr) && sErr.Status().ErrCode == proto.StatusCode_DEPLOY_CLOUD_RUN_GET_SERVICE_ERR {
		if strings.Contains(err.Error(), "403") || strings.Contains(err.Error(), "Permission") {
			return fmt.Errorf("grant roles/run.admin to the caller, then retry: %w", err)
		}
		if strings.Contains(err.Error(), "context deadline") || strings.Contains(err.Error(), "connection") {
			time.Sleep(5 * time.Second)
			return deployer.Deploy(ctx, out, artifacts) // one retry for transient network errors
		}
	}
	return err
}

When it happens

Trigger: `getCall.Do()` returns an error that is not a `*googleapi.Error` with Code 404 — e.g. 403 permission-denied on the project, 401 invalid/expired token, network failure/timeout reaching run.googleapis.com, or a malformed service name producing a 400.

Common situations: Service account lacking `roles/run.admin` (get denied with 403); expired ADC token; corporate proxy or offline network; wrong region configured so the API rejects the parent path; API (run.googleapis.com) not enabled on the project.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

• DEPLOY_CLOUD_RUN_UPDATE_SERVICE_ERR
• StatusCode_DEPLOY_CLOUD_RUN_DELETE_SERVICE_ERR
• StatusCode_DEPLOY_CLOUD_RUN_DELETE_WORKER_POOL_ERR
• failed to iterate objects: %v
• failed to read object: %v

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/92732db6740dc309. Report an issue: GitHub.