Skip to content

Fix GCP Cloud Run deployer timeout for internal/authenticated services#4700

Open
safoinme wants to merge 3 commits intodevelopfrom
fix/fix-gcp-deployer-health-check
Open

Fix GCP Cloud Run deployer timeout for internal/authenticated services#4700
safoinme wants to merge 3 commits intodevelopfrom
fix/fix-gcp-deployer-health-check

Conversation

@safoinme
Copy link
Copy Markdown
Contributor

@safoinme safoinme commented Apr 8, 2026

Describe changes

  • Fixes deployment timeout when using ingress: internal or allow_unauthenticated: false with the GCP Cloud Run deployer
  • Overrides _check_deployment_health() in GCPDeployer to skip the HTTP health check when the service is not publicly accessible, relying on the Cloud Run API state instead.

Pre-requisites

Please ensure you have done the following:

  • I have read the CONTRIBUTING.md document.
  • I have added tests to cover my changes.
  • I have based my new branch on develop and the open PR is targeting develop. If your branch wasn't based on develop read Contribution guide on rebasing branch to develop.
  • IMPORTANT: I made sure that my changes are reflected properly in the following resources:
    • ZenML Docs
    • Dashboard: Needs to be communicated to the frontend team.
    • Templates: Might need adjustments (that are not reflected in the template tests) in case of non-breaking changes and deprecations.
    • Projects: Depending on the version dependencies, different projects might get affected.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Other (add details above)

Copilot AI review requested due to automatic review settings April 8, 2026 13:19
@github-actions github-actions Bot added the internal To filter out internal PRs and issues label Apr 8, 2026
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Apr 8, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f7481d3b-6874-460e-877a-679e5215a95f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/fix-gcp-deployer-health-check

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes Cloud Run deployment timeouts for services that aren’t directly reachable via unauthenticated public HTTP by skipping the base deployer’s HTTP health check and relying on Cloud Run’s API-reported readiness state during polling.

Changes:

  • Override GCPDeployer._check_deployment_health() to bypass requests.get health checks when ingress is restricted or unauthenticated access is disabled.
  • Add debug logging explaining when/why the HTTP health check is skipped.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +1209 to +1218

if settings.ingress != "all" or not settings.allow_unauthenticated:
logger.debug(
"Skipping HTTP health check for deployment "
f"'{deployment.name}' because the Cloud Run service is "
f"not publicly accessible (ingress={settings.ingress!r}, "
f"allow_unauthenticated={settings.allow_unauthenticated}). "
"Relying on Cloud Run API state instead."
)
return True
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The accessibility check uses the raw settings.ingress != "all", but the deploy path later maps unknown ingress values to INGRESS_TRAFFIC_ALL (public) via ingress_mapping.get(settings.ingress, ...). If a user provides an invalid ingress string, the service will be deployed publicly while this method will still skip the HTTP health check (treating it as restricted). Consider validating GCPDeployerSettings.ingress to only allow the known options (e.g., Literal/Enum) or base the check on the resolved/mapped ingress value (same mapping/default) to keep behavior consistent.

Copilot uses AI. Check for mistakes.
Comment thread src/zenml/integrations/gcp/deployers/gcp_deployer.py Outdated
@safoinme safoinme requested a review from bcdurak April 8, 2026 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

internal To filter out internal PRs and issues

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants