# This is a combination of 3 commits.

# This is the 1st commit message:

Refactor service.go logic.

Signed-off-by: agoins <alyssacgoins@gmail.com>

Author: alyssacgoins

backend/src/common/util/service.go

@@ -22,6 +22,7 @@ import (
 	"strings"
 	"time"
 
+	"google.golang.org/grpc/connectivity"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 
@@ -109,16 +110,33 @@ func GetRPCConnectionWithTimeout(address string, tlsCfg *tls.Config, timeout tim
 		creds = credentials.NewTLS(tlsCfg)
 	}
 
-	ctx, _ := context.WithDeadline(context.Background(), timeout)
+	ctx, cancel := context.WithDeadline(context.Background(), timeout)
+	defer cancel()
 
-	conn, err := grpc.DialContext(ctx, address, grpc.WithTransportCredentials(creds), grpc.WithBlock())
+	conn, err := grpc.NewClient(
+		address,
+		grpc.WithTransportCredentials(creds),
+	)
 	if err != nil {
 		return nil, errors.Wrapf(err, "Failed to create gRPC connection")
 	}
+	// Start connection attempts and wait until the connection is ready or the context deadline expires.
+	conn.Connect()
+	state := conn.GetState()
+	for state != connectivity.Ready {
+		if !conn.WaitForStateChange(ctx, state) {
+			_ = conn.Close()
+			if ctx.Err() != nil {
+				return nil, errors.Wrapf(ctx.Err(), "Timed out waiting for gRPC connection")
+			}
+			return nil, errors.New("Failed to connect to gRPC server")
+		}
+		state = conn.GetState()
+	}
 	return conn, nil
 }
 
-func GetRpcConnection(address string, tlsCfg *tls.Config) (*grpc.ClientConn, error) {
+func GetRPCConnection(address string, tlsCfg *tls.Config) (*grpc.ClientConn, error) {
 	creds := insecure.NewCredentials()
 	if tlsCfg != nil {
 		creds = credentials.NewTLS(tlsCfg)
@@ -131,6 +149,9 @@ func GetRpcConnection(address string, tlsCfg *tls.Config) (*grpc.ClientConn, err
 	if err != nil {
 		return nil, errors.Wrapf(err, "Failed to create gRPC connection")
 	}
+	// NewClient does not support a blocking DialOption (grpc.WithBlock is deprecated and not applicable).
+	// Start connection attempts immediately without blocking to preserve eager dialing semantics.
+	conn.Connect()
 	return conn, nil
 }
 

backend/src/common/util/tls_config.go

@@ -1,3 +1,17 @@
+// Copyright 2025 The Kubeflow Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 // Package util provides utility functions.
 package util
 

manifests/kustomize/env/cert-manager/base-tls-certs/kfp-api-cert.yaml

@@ -13,7 +13,6 @@ spec:
     - metadata-envoy-service
     - metadata-grpc-service
     - metadata-grpc-service.kubeflow
-    - metadata-grpc-service.kubeflow.svc
     - localhost
   ipAddresses:
     # Necessary for running TLS-enabled cluster locally.

manifests/kustomize/env/cert-manager/platform-agnostic-standalone-tls/patches/ml-pipeline-apiserver-deployment.yaml

@@ -21,7 +21,7 @@ spec:
             - name: METADATA_TLS_ENABLED
               value: "true"
             - name: METADATA_GRPC_SERVICE_SERVICE_HOST
-              value: "metadata-grpc-service.kubeflow.svc"
+              value: "metadata-grpc-service.kubeflow"
             - name: ML_PIPELINE_SERVICE_HOST
               value: "ml-pipeline.kubeflow.svc.cluster.local"
           readinessProbe: