bee3072568
Add support for Cloud Run v2 jobs * create a separate file for service creation (service.tf) and job (job.tf) - for easy comparison * add E2E tests where possibile * remove default value for input variable `region` * fix subnet range VPC Access Connector example * add creation of service account for audit logs call (trigger requires service account) * use provided trigger service account email in `local.trigger_sa_email`, so explicitly provided SA is passed to trigger * set default value for vpc_connector_create.throughput.max, to match what is set by GCP API, as provider uses wrong default of 300 which results in perma-diff * create inventory fiels for all examples Global changes * (tests) add input variable `project_number`, to allow assigning IAM permissions to Service Accounts in fixtures * (tests) fix not outputting the path, when object is not found in inventory * (tests) fix `create_e2e_sandbox.sh` - now it properly finds root of the repo Secret Manager * added `version_versions` output, to allow specifying versions in other modules. `versions` is sensitive and it makes it unsuitable for `for_each` values New test fixtures * `pubsub.tf` - creating one topic * `secret-credential.tf` - creating Secret Manager `credential` secret * `shared-vpc.tf` - creating two projects (host and service), and vpc in host project * `vpc-connector.tf` - creating VPC Access Connector instance |
||
---|---|---|
.. | ||
README.md | ||
job.tf | ||
main.tf | ||
outputs.tf | ||
service.tf | ||
variables-vpcconnector.tf | ||
variables.tf | ||
versions.tf | ||
vpcconnector.tf |
README.md
Cloud Run Module
Cloud Run Services and Jobs, with support for IAM roles and Eventarc trigger creation.
Examples
IAM and environment variables
IAM bindings support the usual syntax. Container environment values can be declared as key-value strings or as references to Secret Manager secrets. Both can be combined as long as there is no duplication of keys:
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = var.project_id
name = "hello"
region = var.region
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
env = {
VAR1 = "VALUE1"
VAR2 = "VALUE2"
}
env_from_key = {
SECRET1 = {
secret = module.secret-manager.secrets["credentials"].name
version = module.secret-manager.version_versions["credentials:v1"]
}
}
}
}
iam = {
"roles/run.invoker" = ["allUsers"]
}
}
# tftest modules=2 resources=5 fixtures=fixtures/secret-credentials.tf inventory=service-iam-env.yaml e2e
Mounting secrets as volumes
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = var.project_id
name = "hello"
region = var.region
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
volume_mounts = {
"credentials" = "/credentials"
}
}
}
volumes = {
credentials = {
secret = {
name = module.secret-manager.secrets["credentials"].id
path = "my-secret"
version = "latest" # TODO: should be optional, but results in API error
}
}
}
}
# tftest modules=2 resources=4 fixtures=fixtures/secret-credentials.tf inventory=service-volume-secretes.yaml e2e
Beta features
To use beta features like Direct VPC Egress, set the launch stage to a preview stage.
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = var.project_id
name = "hello"
region = var.region
launch_stage = "BETA"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
revision = {
gen2_execution_environment = true
max_instance_count = 20
vpc_access = {
egress = "ALL_TRAFFIC"
subnet = "default"
tags = ["tag1", "tag2", "tag3"]
}
}
}
# tftest modules=1 resources=1 inventory=service-beta-features.yaml
VPC Access Connector
You can use an existing VPC Access Connector to connect to a VPC from Cloud Run.
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = var.project_id
region = var.region
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
revision = {
vpc_access = {
connector = google_vpc_access_connector.connector.id
egress = "ALL_TRAFFIC"
}
}
}
# tftest modules=1 resources=2 fixtures=fixtures/vpc-connector.tf inventory=service-vpc-access-connector.yaml e2e
If creation of the VPC Access Connector is required, use the vpc_connector_create
variable which also supports optional attributes like number of instances, machine type, or throughput. The connector will be used automatically.
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = var.project_id
region = var.region
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
vpc_connector_create = {
ip_cidr_range = "10.10.10.0/28"
network = var.vpc.self_link
instances = {
max = 10
min = 2
}
}
}
# tftest modules=1 resources=2 inventory=service-vpc-access-connector-create.yaml e2e
Note that if you are using a Shared VPC for the connector, you need to specify a subnet and the host project if this is not where the Cloud Run service is deployed.
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = module.project-service.project_id
region = var.region
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
vpc_connector_create = {
machine_type = "e2-standard-4"
subnet = {
name = module.net-vpc-host.subnets["${var.region}/fixture-subnet-28"].name
project_id = module.project-host.project_id
}
}
}
# tftest modules=4 resources=40 fixtures=fixtures/shared-vpc.tf inventory=service-vpc-access-connector-create-sharedvpc.yaml e2e
Eventarc triggers
PubSub
This deploys a Cloud Run service that will be triggered when messages are published to Pub/Sub topics.
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = var.project_id
region = var.region
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
eventarc_triggers = {
pubsub = {
topic-1 = module.pubsub.topic.name
}
}
}
# tftest modules=2 resources=4 fixtures=fixtures/pubsub.tf inventory=service-eventarc-pubsub.yaml e2e
Audit logs
This deploys a Cloud Run service that will be triggered when specific log events are written to Google Cloud audit logs.
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = var.project_id
region = var.region
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
eventarc_triggers = {
audit_log = {
setiampolicy = {
method = "SetIamPolicy"
service = "cloudresourcemanager.googleapis.com"
}
}
service_account_create = true
}
}
# tftest modules=1 resources=4 inventory=service-eventarc-auditlogs-sa-create.yaml
Using custom service accounts for triggers
By default Compute default service account
is used to trigger Cloud Run. If you want to use custom Service Accounts you can either provide your own in eventarc_triggers.service_account_email
or set eventarc_triggers.service_account_create
to true and service account named tf-cr-trigger-${var.name}
will be created with roles/run.invoker
granted on this Cloud Run service.
Example using provided service account:
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = var.project_id
region = var.region
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
eventarc_triggers = {
audit_log = {
setiampolicy = {
method = "SetIamPolicy"
service = "cloudresourcemanager.googleapis.com"
}
}
service_account_email = "cloud-run-trigger@my-project.iam.gserviceaccount.com"
}
}
# tftest modules=1 resources=2 inventory=service-eventarc-auditlogs-external-sa.yaml
Example using automatically created service account:
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = var.project_id
region = var.region
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
eventarc_triggers = {
pubsub = {
topic-1 = module.pubsub.topic.name
}
service_account_create = true
}
}
# tftest modules=2 resources=6 fixtures=fixtures/pubsub.tf inventory=service-eventarc-pubsub-sa-create.yaml e2e
Cloud Run Service Account
To use a custom service account managed by the module, set service_account_create
to true
and leave service_account
set to null
(default).
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = var.project_id
region = var.region
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
service_account_create = true
}
# tftest modules=1 resources=2 inventory=service-sa-create.yaml e2e
To use an externally managed service account, use its email in service_account
and leave service_account_create
to false
(default).
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = var.project_id
region = var.region
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
service_account = module.iam-service-account.email
}
# tftest modules=2 resources=2 fixtures=fixtures/iam-service-account.tf inventory=service-external-sa.yaml e2e
Creating Cloud Run Jobs
To create a job instead of service set create_job
to true
. Jobs support all functions above apart from triggers.
Unsupported variables / attributes:
- ingress
- revision.gen2_execution_environment (they run by default in gen2)
- revision.name
- containers.liveness_probe
- containers.startup_probe
- containers.resources.cpu_idle
- containers.resources.startup_cpu_boost
module "cloud_run" {
source = "./fabric/modules/cloud-run-v2"
project_id = var.project_id
name = "hello"
region = var.region
create_job = true
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
env = {
VAR1 = "VALUE1"
VAR2 = "VALUE2"
}
}
}
iam = {
"roles/run.invoker" = ["group:${var.group_email}"]
}
}
# tftest modules=1 resources=2 inventory=job-iam-env.yaml e2e
Variables
name | description | type | required | default |
---|---|---|---|---|
name | Name used for Cloud Run service. | string |
✓ | |
project_id | Project id used for all resources. | string |
✓ | |
region | Region used for all resources. | string |
✓ | |
containers | Containers in name => attributes format. | map(object({…})) |
{} |
|
create_job | Create Cloud Run Job instead of Service. | bool |
false |
|
eventarc_triggers | Event arc triggers for different sources. | object({…}) |
{} |
|
iam | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | map(list(string)) |
{} |
|
ingress | Ingress settings. | string |
null |
|
labels | Resource labels. | map(string) |
{} |
|
launch_stage | The launch stage as defined by Google Cloud Platform Launch Stages. | string |
null |
|
prefix | Optional prefix used for resource names. | string |
null |
|
revision | Revision template configurations. | object({…}) |
{} |
|
service_account | Service account email. Unused if service account is auto-created. | string |
null |
|
service_account_create | Auto-create service account. | bool |
false |
|
volumes | Named volumes in containers in name => attributes format. | map(object({…})) |
{} |
|
vpc_connector_create | Populate this to create a Serverless VPC Access connector. | object({…}) |
null |
Outputs
name | description | sensitive |
---|---|---|
id | Fully qualified job or service id. | |
job | Cloud Run Job. | |
service | Cloud Run Service. | |
service_account | Service account resource. | |
service_account_email | Service account email. | |
service_account_iam_email | Service account email. | |
service_name | Cloud Run service name. | |
vpc_connector | VPC connector resource if created. |