Repository navigation
fix(functions): suppress premature failure warnings on SA propagation and quota retries - #11325
Open
shettyvarun268 wants to merge 7 commits into
Open
shettyvarun268 wants to merge 7 commits into
shettyvarun268 wants to merge 7 commits into
Conversation
Contributor
There was a problem hiding this comment.
Code Review
This pull request addresses an issue where Cloud Functions deployments logged premature failure warnings when retrying transient service account propagation or quota errors. It updates the error logging logic in both v1 and v2 Cloud Functions modules to log service account propagation errors at the debug level, and adds corresponding unit tests. The review feedback suggests a more robust extraction of error messages when the error is a string, and recommends refactoring the unit tests to clean up stubs and intercepts in afterEach hooks instead of inline try..finally blocks, adhering to the repository style guide.
… and quota retries
When creating, updating, or deleting Cloud Functions hits a newly provisioned
managed service account (firebase-fn-*) propagation delay (HTTP 404/400/403)
or HTTP 429 Quota Exceeded error, functionsOpLogReject previously logged
warning banners ("had HTTP Error..." and "failed to create function...")
before QueueExecutor retried the operation.
This change:
- Logs service account propagation errors at debug level in functionsOpLogReject
instead of emitting premature warning banners on intermediate attempts.
- Suppresses the immediate "failed to <type> function" warning during
HTTP 429 Quota Exceeded retries in GCFv2 (matching GCFv1).
shettyvarun268
force-pushed
the
shettyvarun268/cleanup-sa-propagation-retry-logs
branch
from
October 21, 2026 19:39
6c3dd91 to
71f929f
Compare
…p-sa-propagation-retry-logs
…ed SA 404, and updateFunction
shettyvarun268
marked this pull request as ready for review
October 22, 2026 22:55
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
When deploying Cloud Functions with declarative security, newly provisioned managed service accounts (
firebase-fn-[0-9]+@<project>.iam.gserviceaccount.com) take time to propagate across Google Cloud IAM and downstream services (Cloud Functions, Eventarc, Cloud Run). WhileQueueExecutorretries these transient404/400/403errors,functionsOpLogRejectinsrc/gcp/cloudfunctionsv2.tsandsrc/gcp/cloudfunctions.tspreviously logged immediate failure warnings (⚠ functions: Request to ... had HTTP Error: 404...and⚠ functions: failed to create function ...) before each retry attempt—alarming users even when a subsequent retry succeeded. Similarly, 2nd Gen429Quota Exceeded errors loggedfailed to <type> functionimmediately afterWaiting to retry....This change:
isServiceAccountPropagationError) atdebuglevel infunctionsOpLogRejectinstead of printing warning banners during retries.failed to <type> functionwarning during429Quota Exceeded retries incloudfunctionsv2.ts(matchingcloudfunctions.ts).FirebaseError(Failed to ${type} function ${funcName}: ${errMessage}) so the root cause is still surfaced if all retries are exhausted.Scenarios Tested
requiresRolenewly provisionedfirebase-fn-*service accounts (verified404and403propagation retries log only at--debuglevel with zero premature warning banners and succeed on retry).src/gcp/cloudfunctionsv2.spec.tsandsrc/gcp/cloudfunctions.spec.tsverifying:404,400(Eventarc), and403(Cloud RunactAs) service account propagation errors log atdebuglevel without emitting warning banners acrosscreateFunctionandupdateFunction.404errors still log warning banners immediately.429Quota Exceeded errors incloudfunctionsv2only log theWaiting to retry...warning.Sample Commands
firebase deploy --only functions