* IAM modules refactor proposal * policy * subheading * Update 20230816-iam-refactor.md * log Julio's +1 * data-catalog-policy-tag * dataproc * dataproc * folder * folder * folder * folder * project * better filtering in test examples * project * folder * folder * organization * fix variable descriptions * kms * net-vpc * dataplex-datascan * modules/iam-service-account * modules/source-repository/ * blueprints/cloud-operations/vm-migration/ * blueprints/third-party-solutions/wordpress * dataplex-datascan * blueprints/cloud-operations/workload-identity-federation * blueprints/data-solutions/cloudsql-multiregion/ * blueprints/data-solutions/composer-2 * Update 20230816-iam-refactor.md * Update 20230816-iam-refactor.md * capture discussion in architectural doc * update variable names and refactor proposal * project * blueprints first round * folder * organization * data-catalog-policy-tag * re-enable folder inventory * project module style fix * dataproc * source-repository * source-repository tests * dataplex-datascan * dataplex-datascan tests * net-vpc * net-vpc test examples * iam-service-account * iam-service-account test examples * kms * boilerplate * tfdoc * fix module tests * more blueprint fixes * fix typo in data blueprints * incomplete refactor of data platform foundations * tfdoc * data platform foundation * refactor data platform foundation iam locals * remove redundant example test * shielded folder fix * fix typo * project factory * project factory outputs * tfdoc * test workflow: less verbose tests, fix tf version * re-enable -vv, shorter traceback, fix action version * ignore github extension warning, re-enable action version * fast bootstrap IAM, untested * bootstrap stage IAM fixes * stage 0 tests * fast stage 1 * tenant stage 1 * minor changes to fast stage 0 and 1 * fast security stage * fast mt stage 0 * fast mt stage 0 * fast pf |
||
---|---|---|
.. | ||
README.md | ||
main.tf | ||
outputs.tf | ||
variables.tf | ||
versions.tf |
README.md
Cloud Run Module
Cloud Run management, with support for IAM roles, revision annotations and optional Eventarc trigger creation.
Examples
IAM and environment variables
IAM bindings support the usual syntax. Container environment values can be declared as key-value strings or as references to Secret Manager secrets. Both can be combined as long as there's no duplication of keys:
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = "my-project"
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
env = {
VAR1 = "VALUE1"
VAR2 = "VALUE2"
}
env_from = {
SECRET1 = {
name = "credentials"
key = "1"
}
}
}
}
iam = {
"roles/run.invoker" = ["allUsers"]
}
}
# tftest modules=1 resources=2 inventory=simple.yaml
Mounting secrets as volumes
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = var.project_id
name = "hello"
region = var.region
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
volume_mounts = {
"credentials" = "/credentials"
}
}
}
volumes = {
credentials = {
name = "credentials"
secret_name = "credentials"
items = {
v1 = { path = "v1.txt" }
}
}
}
}
# tftest modules=1 resources=1 inventory=secrets.yaml
Revision annotations
Annotations can be specified via the revision_annotations
variable:
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = var.project_id
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
revision_annotations = {
autoscaling = {
max_scale = 10
min_scale = 1
}
cloudsql_unstances = ["sql-0", "sql-1"]
vpcaccess_connector = "foo"
vpcaccess_egress = "all-traffic"
}
}
# tftest modules=1 resources=1 inventory=revision-annotations.yaml
Second generation execution environment
Second generation execution environment (gen2) can be enabled by setting the gen2_execution_environment
variable to true:
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = var.project_id
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
gen2_execution_environment = true
}
# tftest modules=1 resources=1 inventory=gen2.yaml
VPC Access Connector creation
If creation of a VPC Access Connector is required, use the vpc_connector_create
variable which also support optional attributes for number of instances, machine type, and throughput (not shown here). The annotation to use the connector will be added automatically.
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = var.project_id
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
vpc_connector_create = {
ip_cidr_range = "10.10.10.0/24"
vpc_self_link = "projects/example/host/global/networks/host"
}
}
# tftest modules=1 resources=2 inventory=connector.yaml
Note that if you are using Shared VPC you need to specify a subnet:
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = var.project_id
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
vpc_connector_create = {
subnet = {
name = "subnet-vpc-access"
project_id = "host-project"
}
}
}
# tftest modules=1 resources=2 inventory=connector-shared.yaml
Traffic split
This deploys a Cloud Run service with traffic split between two revisions.
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = "my-project"
name = "hello"
revision_name = "green"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
traffic = {
blue = { percent = 25 }
green = { percent = 75 }
}
}
# tftest modules=1 resources=1 inventory=traffic.yaml
Eventarc triggers
PubSub
This deploys a Cloud Run service that will be triggered when messages are published to Pub/Sub topics.
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = "my-project"
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
eventarc_triggers = {
pubsub = {
topic-1 = "topic1"
topic-2 = "topic2"
}
}
}
# tftest modules=1 resources=3 inventory=eventarc.yaml
Audit logs
This deploys a Cloud Run service that will be triggered when specific log events are written to Google Cloud audit logs.
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = "my-project"
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
eventarc_triggers = {
audit_log = {
setiampolicy = {
method = "SetIamPolicy"
service = "cloudresourcemanager.googleapis.com"
}
}
}
}
# tftest modules=1 resources=2 inventory=audit-logs.yaml
Using custom service accounts for triggers
By default Compute default service account
is used to trigger Cloud Run. If you want to use custom Service Account you can either provide your own in eventarc_triggers.service_account_email
or set eventarc_triggers.service_account_create
to true and service account named tf-cr-trigger-${var.name}
will be created with roles/run.invoker
granted on this Cloud Run service.
Example using provided service account:
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = "my-project"
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
eventarc_triggers = {
audit_log = {
setiampolicy = {
method = "SetIamPolicy"
service = "cloudresourcemanager.googleapis.com"
}
}
service_account_email = "cloud-run-trigger@my-project.iam.gserviceaccount.com"
}
}
# tftest modules=1 resources=2 inventory=trigger-service-account-external.yaml
Example using automatically created service account:
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = "my-project"
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
eventarc_triggers = {
pubsub = {
topic-1 = "topic1"
topic-2 = "topic2"
}
service_account_create = true
}
}
# tftest modules=1 resources=5 inventory=trigger-service-account.yaml
Service account
To use a custom service account managed by the module, set service_account_create
to true
and leave service_account
set to null
value (default).
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = "my-project"
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
service_account_create = true
}
# tftest modules=1 resources=2 inventory=service-account.yaml
To use an externally managed service account, pass its email in service_account
and leave service_account_create
to false
(the default).
module "cloud_run" {
source = "./fabric/modules/cloud-run"
project_id = "my-project"
name = "hello"
containers = {
hello = {
image = "us-docker.pkg.dev/cloudrun/container/hello"
}
}
service_account = "cloud-run@my-project.iam.gserviceaccount.com"
}
# tftest modules=1 resources=1 inventory=service-account-external.yaml
Variables
name | description | type | required | default |
---|---|---|---|---|
name | Name used for cloud run service. | string |
✓ | |
project_id | Project id used for all resources. | string |
✓ | |
container_concurrency | Maximum allowed in-flight (concurrent) requests per container of the revision. | string |
null |
|
containers | Containers in arbitrary key => attributes format. | map(object({…})) |
{} |
|
eventarc_triggers | Event arc triggers for different sources. | object({…}) |
{} |
|
gen2_execution_environment | Use second generation execution environment. | bool |
false |
|
iam | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | map(list(string)) |
{} |
|
ingress_settings | Ingress settings. | string |
null |
|
labels | Resource labels. | map(string) |
{} |
|
prefix | Optional prefix used for resource names. | string |
null |
|
region | Region used for all resources. | string |
"europe-west1" |
|
revision_annotations | Configure revision template annotations. | object({…}) |
{} |
|
revision_name | Revision name. | string |
null |
|
service_account | Service account email. Unused if service account is auto-created. | string |
null |
|
service_account_create | Auto-create service account. | bool |
false |
|
startup_cpu_boost | Enable startup cpu boost. | bool |
false |
|
timeout_seconds | Maximum duration the instance is allowed for responding to a request. | number |
null |
|
traffic | Traffic steering configuration. If revision name is null the latest revision will be used. | map(object({…})) |
{} |
|
volumes | Named volumes in containers in name => attributes format. | map(object({…})) |
{} |
|
vpc_connector_create | Populate this to create a VPC connector. You can then refer to it in the template annotations. | object({…}) |
null |
Outputs
name | description | sensitive |
---|---|---|
id | Fully qualified service id. | |
service | Cloud Run service. | |
service_account | Service account resource. | |
service_account_email | Service account email. | |
service_account_iam_email | Service account email. | |
service_name | Cloud Run service name. | |
vpc_connector | VPC connector resource if created. |