404 error when using Google Cloud Scheduler to run Docker container on Cloud Run

Question

I am posting a follow on question to this one that I posted recently: Docker container failed to start when deploying to Google Cloud Run. I am new to GCP, and am trying to teach myself by deploying a simple R script in a Docker container that connects to BigQuery and writes the system time. I've been able to successfully deploy the Docker container, but I cannot invoke it. I believe I'm misunderstanding something fundamental about APIs, and I'd greatly appreciate any input!

So far, I have:

1.- Used the plumber R package to expose the R code as a service by "decorating" it with special annotations

# script called big-query-tutorial.R
library(bigrquery)
library(tidyverse)

project = "xxxx-project"
dataset = "xxxx-dataset"
table = "xxxx-table"

bq_auth("/home/rstudio/xxxx-xxxx.json", email="[email protected]")

#* @get /time
systime <- function(){
    # upload Sys.time() to Big Query
    insert_upload_job(project=project, data=dataset, table=table, write_disposition="WRITE_APPEND", values=Sys.time() %>% as_tibble(), billing=project)
}

2.- Translated the R code from (1) to a plumber API with this R script

# script called main.R    
library(plumber)

r <- plumb("/home/rstudio/big-query-tutorial.R")
r$run(host="0.0.0.0", port=8080)

3.- Made the Dockerfile

FROM rocker/tidyverse:latest

# BEGIN rstudio/plumber layers
RUN apt-get update -qq && apt-get install -y --no-install-recommends \
  git-core \
  libssl-dev \
  libcurl4-gnutls-dev \
  curl \
  libsodium-dev \
  libxml2-dev
  
RUN R -e "install.packages('plumber', repos='http://cran.us.r-project.org')"
RUN R -e "install.packages('bigrquery', repos='http://cran.us.r-project.org')"


# add json file for authentication with BigQuery and necessary R scripts
ADD xxxx-xxxx.json /home/rstudio
ADD big-query-tutorial.R /home/rstudio
ADD main.R /home/rstudio

# open port 8080 to traffic
EXPOSE 8080

# when the container starts, start the main.R script
ENTRYPOINT ["Rscript", "/home/rstudio/main.R", "--host", "0.0.0.0"]

4.- Successfully run the container locally on my machine, with the system time being written to BigQuery when I visit http://0.0.0.0:8080/time and then refresh the browser.

5.- Pushed the container to my container registry in Google Cloud

6.- Successfully deployed the container to Cloud Run.

7.- Created a service account (i.e., [email protected]) that has roles "Cloud Run Invoker" and "Cloud Scheduler Service Agent".

8.- Set up a Cloud Scheduler job by filling out the fields in the console as follows

Frequency: ***** (i.e., once per minute)
Timezone: Pacific Standard Time (PST)
Target: HTTP
URL: xxxx-xxxx.run.app
HTTP method: GET
Auth header: Add OIDC token
Service account: [email protected] (i.e., account from (7))
Audience: xxxx-xxxx.run.app (I leave this field blank, it is automatically added)

When I click on "RUN NOW" in Cloud Scheduler, I get the error

httpRequest: {
status: 404
}

When I check the log for Cloud Run, every minute there is the 404 error. The request count under the "METRICS" tab averages out to 0.02/s.

Thank you! -H.

If you 404, ut means the page/url might be wrong. Check first that. — Pentium10
Change the URL value by https://xxxx-xxxx.run.app/time. The / patch should not be handled, and return NotFound. — guillaume blaquiere

Pentium10 Pentium10 · Accepted Answer · 2020-12-01T09:25:12

A couple of recommendations:

Make sure your service account has roles/iam.serviceAccountTokenCreator and roles/cloudscheduler.serviceAgent that will enable impersonation. And roles/run.Invoker to be able to call Cloud Run.

Also you have chosen OIDC Audience

A bit about the audience: field in OIDC tokens. You must set this field for the invoking service and specify the fully qualified URL of the receiving service. For example, if you are invoking Cloud Run or Cloud Functions, the id_token must include the URL/path of the service.

Example declaration:

gcloud beta scheduler jobs create http oidctest  --schedule "5 * * * *" --http-method=GET \
  --uri=https://hello-6w42z6vi3q-uc.a.run.app \
  --oidc-service-account-email=schedulerunner@$PROJECT_ID.iam.gserviceaccount.com    \
  --oidc-token-audience=https://hello-6w42z6vi3q-uc.a.run.app

404 error when using Google Cloud Scheduler to run Docker container on Cloud Run

1 Answers