Skip to content

fix(functions): suppress premature failure warnings on SA propagation and quota retries - #11325

Open
shettyvarun268 wants to merge 7 commits into
mainfrom
shettyvarun268/cleanup-sa-propagation-retry-logs
Open

shettyvarun268 wants to merge 7 commits into
mainfrom
shettyvarun268/cleanup-sa-propagation-retry-logs

Conversation

@shettyvarun268

@shettyvarun268 shettyvarun268 commented Oct 21, 2026 •

Copy link
Copy Markdown
Contributor

Description

When deploying Cloud Functions with declarative security, newly provisioned managed service accounts (firebase-fn-[0-9]+@<project>.iam.gserviceaccount.com) take time to propagate across Google Cloud IAM and downstream services (Cloud Functions, Eventarc, Cloud Run). While QueueExecutor retries these transient 404/400/403 errors, functionsOpLogReject in src/gcp/cloudfunctionsv2.ts and src/gcp/cloudfunctions.ts previously logged immediate failure warnings (⚠ functions: Request to ... had HTTP Error: 404... and ⚠ functions: failed to create function ...) before each retry attempt—alarming users even when a subsequent retry succeeded. Similarly, 2nd Gen 429 Quota Exceeded errors logged failed to <type> function immediately after Waiting to retry....

This change:

  • Logs service account propagation errors (isServiceAccountPropagationError) at debug level in functionsOpLogReject instead of printing warning banners during retries.
  • Suppresses the immediate failed to <type> function warning during 429 Quota Exceeded retries in cloudfunctionsv2.ts (matching cloudfunctions.ts).
  • Preserves the underlying GCP error message in the thrown FirebaseError (Failed to ${type} function ${funcName}: ${errMessage}) so the root cause is still surfaced if all retries are exhausted.

Scenarios Tested

  • Live GCP deployment of 2nd Gen functions with requiresRole newly provisioned firebase-fn-* service accounts (verified 404 and 403 propagation retries log only at --debug level with zero premature warning banners and succeed on retry).
  • Unit tests in src/gcp/cloudfunctionsv2.spec.ts and src/gcp/cloudfunctions.spec.ts verifying:
    • 404, 400 (Eventarc), and 403 (Cloud Run actAs) service account propagation errors log at debug level without emitting warning banners across createFunction and updateFunction.
    • Non-managed service account 404 errors still log warning banners immediately.
    • 429 Quota Exceeded errors in cloudfunctionsv2 only log the Waiting to retry... warning.

Sample Commands

firebase deploy --only functions

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request addresses an issue where Cloud Functions deployments logged premature failure warnings when retrying transient service account propagation or quota errors. It updates the error logging logic in both v1 and v2 Cloud Functions modules to log service account propagation errors at the debug level, and adds corresponding unit tests. The review feedback suggests a more robust extraction of error messages when the error is a string, and recommends refactoring the unit tests to clean up stubs and intercepts in afterEach hooks instead of inline try..finally blocks, adhering to the repository style guide.

Comment thread src/gcp/cloudfunctions.ts Outdated
Comment thread src/gcp/cloudfunctionsv2.ts Outdated
Comment thread src/gcp/cloudfunctions.spec.ts
Comment thread src/gcp/cloudfunctionsv2.spec.ts
… and quota retries

When creating, updating, or deleting Cloud Functions hits a newly provisioned
managed service account (firebase-fn-*) propagation delay (HTTP 404/400/403)
or HTTP 429 Quota Exceeded error, functionsOpLogReject previously logged
warning banners ("had HTTP Error..." and "failed to create function...")
before QueueExecutor retried the operation.

This change:
- Logs service account propagation errors at debug level in functionsOpLogReject
  instead of emitting premature warning banners on intermediate attempts.
- Suppresses the immediate "failed to <type> function" warning during
  HTTP 429 Quota Exceeded retries in GCFv2 (matching GCFv1).
@shettyvarun268
shettyvarun268 force-pushed the shettyvarun268/cleanup-sa-propagation-retry-logs branch from 6c3dd91 to 71f929f Compare October 21, 2026 19:39
@shettyvarun268 shettyvarun268 changed the title fix(functions): suppress premature failure warnings on SA propagation… ix(functions): suppress premature failure warnings on SA propagation and quota retries Oct 22, 2026
@shettyvarun268 shettyvarun268 changed the title ix(functions): suppress premature failure warnings on SA propagation and quota retries fix(functions): suppress premature failure warnings on SA propagation and quota retries Oct 22, 2026
@shettyvarun268
shettyvarun268 marked this pull request as ready for review October 22, 2026 22:55

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant