IssueTracker

Hello,

Thank you for reaching out to us!

Have you gone through with this Troubleshooting Documentation. If the suggestions doesn’t helps you in resolving the issue run the gcloud command again with the flag to display debug information:

gcloud --verbosity=debug endpoints services deploy openapi.yaml

If above suggestions doesn’t helps you in resolving the issue, we kindly request your cooperation in providing the following information regarding the reported issue:

1. Can you try downgrading the gcloud version to 489.0.0 and redeploying. See whether you get the old URL format of the service back.
2. Do you see this issue constantly or intermittently ?
3. If this issue is seen intermittently, then how often do you observe this issue ? Is there any specific scenario or time at which this issue is observed ?
4. To help us understand the issue better, please provide detailed steps to reliably reproduce the problem.
5. It would be greatly helpful if you could attach screenshots of the output related to this issue.

Your cooperation in providing these details will enable us to dive deeper into the matter and work towards a prompt resolution. We appreciate your assistance and look forward to resolving this issue for you.

Thank you for your understanding and cooperation.

All Cloud Run service have a hash-based URL. Recently, they also received a second deterministic URL: https://cloud.google.com/run/docs/triggering/https-request#url

As it has been documented for a while, the hash based URL isn't intended to be parsed and should be treated as opaque URL by customers. The deterministic URL now has a documented schema that is OK to parse or construct or take a dependency on.

The Cloud Run API or gcloud run services describe --format yaml commands haven't changed and are always returning the hash based URL at the same location (Service.status.url).

Clients which display information in a human readable way (Cloud Console, gcloud run services describe or gcloud run services list are now prioritizing displaying the deterministic URL.

Could you share why a change in the URL displayed by the list command is breaking? If you parse this command's output, I would suggest to update your logic to gcloud run services list --format yaml.

I'm encountering the same issue. I'm updating the CI/CD pipeline of an app that has been running in production since 2021, running on Cloud Run with an ESPv2 container in front of it.

The error I'm encountering (which I'm also able to reproduce locally) happens when performing this command:

gcloud --verbosity=debug endpoints services deploy configs/endpoints/openapi-run.yaml --project <my-gcp-project-name>

This results in:

DEBUG: Running [gcloud.endpoints.services.deploy] with arguments: [--project: "gcp-project-name", --verbosity: "debug", SERVICE_CONFIG_FILE:1: "['configs/endpoints/openapi-run.yaml']"]
INFO: No JSON detected in service config. Trying YAML...
DEBUG: Starting new HTTPS connection (1): servicemanagement.googleapis.com:443
DEBUG: https://servicemanagement.googleapis.com:443 "GET /v1/services/name-project-id.region.run.app?alt=json HTTP/1.1" 403 None
DEBUG: Starting new HTTPS connection (1): servicemanagement.googleapis.com:443
DEBUG: https://servicemanagement.googleapis.com:443 "POST /v1/services?alt=json HTTP/1.1" 403 None
DEBUG: (gcloud.endpoints.services.deploy) PERMISSION_DENIED: Ownership for domain name 'name-project-id.region.run.app' on project 'gcp-project-name' cannot be verified.
Traceback (most recent call last):
  File "/Users/nielsrogge/google-cloud-sdk/lib/googlecloudsdk/calliope/cli.py", line 998, in Execute
    resources = calliope_command.Run(cli=self, args=args)
  File "/Users/nielsrogge/google-cloud-sdk/lib/googlecloudsdk/calliope/backend.py", line 815, in Run
    resources = command_instance.Run(args)
  File "/Users/nielsrogge/google-cloud-sdk/lib/surface/endpoints/services/deploy.py", line 350, in Run
    services_util.CreateService(self.service_name, project_id)
  File "/Users/nielsrogge/google-cloud-sdk/lib/googlecloudsdk/api_lib/endpoints/services_util.py", line 432, in CreateService
    result = client.services.Create(create_request)
  File "/Users/nielsrogge/google-cloud-sdk/lib/googlecloudsdk/generated_clients/apis/servicemanagement/v1/servicemanagement_v1_client.py", line 583, in Create
    return self._RunMethod(
  File "/Users/nielsrogge/google-cloud-sdk/lib/third_party/apitools/base/py/base_api.py", line 737, in _RunMethod
    return self.ProcessHttpResponse(method_config, http_response, request)
  File "/Users/nielsrogge/google-cloud-sdk/lib/third_party/apitools/base/py/base_api.py", line 743, in ProcessHttpResponse
    self.__ProcessHttpResponse(method_config, http_response, request))
  File "/Users/nielsrogge/google-cloud-sdk/lib/third_party/apitools/base/py/base_api.py", line 609, in __ProcessHttpResponse
    raise exceptions.HttpError.FromResponse(
apitools.base.py.exceptions.HttpForbiddenError: HttpError accessing <https://servicemanagement.googleapis.com/v1/services?alt=json>: response: <{'x-debug-tracking-id': '12441350098649976867;o=0', 'vary': 'Origin, X-Origin, Referer', 'content-type': 'application/json; charset=UTF-8', 'content-encoding': 'gzip', 'date': 'Thu, 05 Sep 2024 18:44:21 GMT', 'server': 'ESF', 'cache-control': 'private', 'x-xss-protection': '0', 'x-frame-options': 'SAMEORIGIN', 'x-content-type-options': 'nosniff', 'alt-svc': 'h3=":443"; ma=2592000,h3-29=":443"; ma=2592000', 'transfer-encoding': 'chunked', 'status': 403}>, content <{
  "error": {
    "code": 403,
    "message": "Ownership for domain name 'name-project-id.region.run.app' on project 'gcp-project-name' cannot be verified.",
    "status": "PERMISSION_DENIED"
  }
}
>
ERROR: (gcloud.endpoints.services.deploy) PERMISSION_DENIED: Ownership for domain name 'name-project-id.region.run.app' on project 'gcp-project-name' cannot be verified.

Note: I've replaced the actual cloud run URL by name-project-id.region.run.app and the actual project name by 'gcp-project-name'.

Things I've tried:

• verifying the required roles/permissions for my account. I have the Service Config Editor role.
• reading the troubleshooting guide: https://cloud.google.com/endpoints/docs/openapi/troubleshoot-config-deployment#ownership-for-domain-name-cannot-be-verified, however I am not using a domain name.

Thanks. It seems to be an issue for Cloud Endpoint. We'll route internally

Hello,

Thank you for reaching out to us with your request.

We have duly noted your feedback and will thoroughly validate it. While we cannot provide an estimated time of implementation or guarantee the fulfillment of the issue, please be assured that your input is highly valued. Your feedback enables us to enhance our products and services.

We appreciate your continued trust and support in improving our Google Cloud Platform products. In case you want to report a new issue, please do not hesitate to create a new issue on the Issue Tracker providing a detailed description of your issue.

Once again, we sincerely appreciate your valuable feedback; Thank you for your understanding and collaboration.