{"record":{"id":"92732db6740dc309","repo":"GoogleContainerTools/skaffold","slug":"deploy-cloud-run-get-service-err","errorCode":"DEPLOY_CLOUD_RUN_GET_SERVICE_ERR","errorMessage":"error checking Cloud Run State: %w","messagePattern":"error checking Cloud Run State: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/deploy/cloudrun/deploy.go","lineNumber":294,"sourceCode":"\t\t}\n\t}\n\tresName := RunResourceName{\n\t\tProject: service.Metadata.Namespace,\n\t\tRegion:  d.Region,\n\t\tService: service.Metadata.Name,\n\t}\n\toutput.Default.Fprintln(out, \"Deploying Cloud Run service:\\n\\t\", service.Metadata.Name)\n\tparent := fmt.Sprintf(\"projects/%s/locations/%s\", service.Metadata.Namespace, d.Region)\n\n\tsName := resName.String()\n\td.logger.AddResource(resName)\n\tgetCall := crclient.Projects.Locations.Services.Get(sName)\n\t_, err := getCall.Do()\n\n\tif err != nil {\n\t\tgErr, ok := err.(*googleapi.Error)\n\t\tif !ok || gErr.Code != http.StatusNotFound {\n\t\t\treturn nil, sErrors.NewError(fmt.Errorf(\"error checking Cloud Run State: %w\", err), &proto.ActionableErr{\n\t\t\t\tMessage: err.Error(),\n\t\t\t\tErrCode: proto.StatusCode_DEPLOY_CLOUD_RUN_GET_SERVICE_ERR,\n\t\t\t})\n\t\t}\n\t\t// This is a new service, we need to create it\n\t\tcreateCall := crclient.Projects.Locations.Services.Create(parent, service)\n\t\t_, err = createCall.Do()\n\t} else {\n\t\treplaceCall := crclient.Projects.Locations.Services.ReplaceService(sName, service)\n\t\t_, err = replaceCall.Do()\n\t}\n\tif err != nil {\n\t\treturn nil, sErrors.NewError(fmt.Errorf(\"error deploying Cloud Run Service: %s\", err), &proto.ActionableErr{\n\t\t\tMessage: err.Error(),\n\t\t\tErrCode: proto.StatusCode_DEPLOY_CLOUD_RUN_UPDATE_SERVICE_ERR,\n\t\t})\n\t}\n\treturn &resName, nil","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/deploy/cloudrun/deploy.go#L276-L312","documentation":"To decide between creating and replacing a service, `deployService` calls the Cloud Run API `Projects.Locations.Services.Get(sName)`. If the call fails with anything other than a googleapi 404 (which would mean 'new service, create it'), the error is wrapped as 'error checking Cloud Run State: %w' with code DEPLOY_CLOUD_RUN_GET_SERVICE_ERR.","triggerScenarios":"`getCall.Do()` returns an error that is not a `*googleapi.Error` with Code 404 — e.g. 403 permission-denied on the project, 401 invalid/expired token, network failure/timeout reaching run.googleapis.com, or a malformed service name producing a 400.","commonSituations":"Service account lacking `roles/run.admin` (get denied with 403); expired ADC token; corporate proxy or offline network; wrong region configured so the API rejects the parent path; API (run.googleapis.com) not enabled on the project.","solutions":["Check the wrapped error's HTTP code: enable the Cloud Run API (`gcloud services enable run.googleapis.com`) if the API is disabled","Fix permissions: grant the caller `roles/run.admin` or at least run.services.get on the project","Re-authenticate (`gcloud auth application-default login`) if the code is 401","Verify the configured region matches where the service lives; test with `gcloud run services describe <name> --region <region>`","Check network/proxy connectivity to run.googleapis.com if the error is a transport error"],"exampleFix":"# before: 403 permission denied\ngcloud projects add-iam-policy-binding my-project \\\n  --member=serviceAccount:ci@my-project.iam.gserviceaccount.com \\\n  --role=roles/run.admin\n# then re-run skaffold deploy","handlingStrategy":"retry","validationCode":"func preflightCloudRunAccess(project, region string) error {\n\tcmd := exec.Command(\"gcloud\", \"run\", \"services\", \"list\", \"--project\", project, \"--region\", region, \"--limit\", \"1\")\n\tcmd.Stderr = os.Stderr\n\treturn cmd.Run() // fails early on 403/401/network/API-not-enabled\n}","typeGuard":null,"tryCatchPattern":"if err := deployer.Deploy(ctx, out, artifacts); err != nil {\n\tvar sErr *sErrors.Error\n\tif errors.As(err, &sErr) && sErr.Status().ErrCode == proto.StatusCode_DEPLOY_CLOUD_RUN_GET_SERVICE_ERR {\n\t\tif strings.Contains(err.Error(), \"403\") || strings.Contains(err.Error(), \"Permission\") {\n\t\t\treturn fmt.Errorf(\"grant roles/run.admin to the caller, then retry: %w\", err)\n\t\t}\n\t\tif strings.Contains(err.Error(), \"context deadline\") || strings.Contains(err.Error(), \"connection\") {\n\t\t\ttime.Sleep(5 * time.Second)\n\t\t\treturn deployer.Deploy(ctx, out, artifacts) // one retry for transient network errors\n\t\t}\n\t}\n\treturn err\n}","preventionTips":["Verify API access with `gcloud run services list` before running skaffold deploy","Grant the deploying identity roles/run.admin (or run.services.get + replace permissions)","Enable run.googleapis.com on the target project","Confirm the configured region and stable network/proxy connectivity to googleapis.com"],"tags":["cloud-run","api","network","permissions"],"backgroundTag":"api-request-failed","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}