Project ID: (PII Removed by Staff)
Project number: (PII Removed by Staff)
Issue:
Cloud Run run.app URLs return a Google-branded HTTP 404 before requests reach the container. No Cloud Run revision request logs are produced for these requests.
The same container image was tested locally and /healthz returns HTTP 200 {“ok”:true}.
User (PII Removed by Staff)@albarqsalh70 was granted roles/run.invoker.
Dedicated service account (PII Removed by Staff)@ace-citizen-portal-demo.iam.gserviceaccount.com was granted roles/run.invoker.
A service-account identity token was generated successfully with the Cloud Run service URL as audience.
Both user-token and service-account-token requests return the same Google-branded 404.
Requests do not appear in Cloud Run revision/container logs.
Re-authentication, service update, delete/redeploy, and different-region deployment did not resolve the issue.
Also observed:
gcloud previously emitted repeated warnings:
Regional Access Boundary HTTP request failed
Gaia id not found / Account not found for (PII Removed by Staff)@albarqsalh70
Request:
Please inspect Cloud Run run.app hostname provisioning and Google Frontend routing table registration for project (PII Removed by Staff). Please also confirm whether the Regional Access Boundary / Gaia identity-resolution warnings are related to the run.app routing failure.
No bearer tokens or credentials are included in this case.
I am seeing the same issue in a newly created Google Cloud project.
Region: europe-west9
Service type: Cloud Run fully managed
Service state:
Ready=True
ConfigurationsReady=True
RoutesReady=True
100% traffic to the latest ready revision
ingress=all
default run.app URL enabled
allUsers has roles/run.invoker
The container starts successfully and logs that it is listening on the configured port. Local genuine execution tests pass.
However, both run.app URL formats return the Google-branded HTTP 404 page before reaching the container. No corresponding Cloud Run request logs are produced.
The same 404 is returned:
from a local curl request
through gcloud run services proxy
from Google Cloud Shell
gcloud and Cloud Shell also emit:
“Regional Access Boundary HTTP request failed”
“Gaia id not found for email …”
Updating the service with --default-url did not resolve the issue.
I can provide the project ID, project number and service URL privately to Google staff. No credentials or secrets will be shared publicly.
Confirming the same issue in another newly created, billing-enabled Google Cloud project as of August 10, 2026.
Affected services:
(PII Removed by Staff)
For both services:
Ready, ConfigurationsReady, and RoutesReady are True.
100% of traffic targets the latest ready revision.
Ingress is all; the default HTTPS endpoint is explicitly enabled.
allUsers has roles/run.invoker.
The container starts successfully and logs that it is listening on port 8080.
The same source passes local tests and GET /healthz returns JSON with HTTP 200 locally.
Both deterministic and non-deterministic run.app URLs instead return Google’s branded HTTP 404 page. The result is identical from a Windows client and Google Cloud Shell. Deploying the same service in a second region, assigning a traffic tag, and running gcloud run services update --default-url did not resolve it. These /healthz requests do not appear in Cloud Run revision request logs, indicating they do not reach the container.
Please investigate Cloud Run hostname provisioning / Google Frontend routing for newly created projects. I can provide the project ID, project number, exact URLs, and timestamps privately to Google staff. No credentials, tokens, or secrets are included here.