cloudrun instance fails tcp healthcheck

[araji-collibra]

Environment
Google Cloud, PostreSQL 15 runs in Cloud SQL

PostgreSQL version: 15
PostgREST version: Docker, latest
Operating system:
Description of issue:
cloudrun tcp healthcheck fails after no errors (That I can see) :

STARTUP TCP probe failed 5 times consecutively for container "pgrest-1" on port 3000. The instance was not started.
....

DEFAULT 2023-07-03T21:49:53.679190Z 03/Jul/2023:21:49:53 +0000: Schema cache loaded
DEFAULT 2023-07-03T21:49:53.510937Z 03/Jul/2023:21:49:53 +0000: Config reloaded
DEFAULT 2023-07-03T21:49:53.501163Z 03/Jul/2023:21:49:53 +0000: Listening for notifications on the pgrst channel
DEFAULT 2023-07-03T21:49:53.464918Z 03/Jul/2023:21:49:53 +0000: Listening on port 3000
DEFAULT 2023-07-03T21:49:53.464582Z 03/Jul/2023:21:49:53 +0000: Connection successful
DEFAULT 2023-07-03T21:49:53.422871Z 03/Jul/2023:21:49:53 +0000: Attempting to connect to the database...

checked existing discussions and increased both Postgres and cloudrun cp/mem but no luck so far so any help is greatly appreciated!

[laurenceisla]

I'm not familiarized with Cloudrun, but if you can configure your Probes, you can use PostgREST's Health Check endpoint. You'll need to add the env to the pgrest-1 container, e.g. PGRST_ADMIN_SERVER_PORT=3001, then the ready check should be done to the ready endpoint, that is localhost:3001/ready (not the default port 3000).

Also check that the ports are correctly mapped, maybe Probe uses the mapped ports to check?

[araji-collibra]

Thanks @laurenceisla , A firewall rule in my case was the culprit and as soon as that cleared I was able to query the service.but ...
I am now facing the issue that both my cloudrun instance (private ) and the backend service (postgres) depend on the JWT header so when I use the correct auth header for my service , postgrest complains:

{"code":"PGRST301","details":null,"hint":null,"message":"JWSError JWSInvalidSignature"}

Thanks again for the quick help, will go through the docs in case I missed something .

[laurenceisla]

A firewall rule in my case was the culprit and as soon as that cleared I was able to query the service

Cool.

"message":"JWSError JWSInvalidSignature"

This would mean that the JWT sent cannot be decoded using the secret provided to PostgREST. Did the secret change for any of the containers? or maybe they have different secrets and somehow the requests are mixing the JWTs. You can verify if the token and the secret match in https://jwt.io/