374 lines
17 KiB
Markdown
374 lines
17 KiB
Markdown
# Cloud Run Module
|
|
|
|
Cloud Run management, with support for IAM roles, revision annotations and optional Eventarc trigger creation.
|
|
|
|
## Examples
|
|
|
|
<!-- BEGIN TOC -->
|
|
- [Examples](#examples)
|
|
- [IAM and environment variables](#iam-and-environment-variables)
|
|
- [Mounting secrets as volumes](#mounting-secrets-as-volumes)
|
|
- [Revision annotations](#revision-annotations)
|
|
- [Second generation execution environment](#second-generation-execution-environment)
|
|
- [VPC Access Connector creation](#vpc-access-connector-creation)
|
|
- [Traffic split](#traffic-split)
|
|
- [Eventarc triggers](#eventarc-triggers)
|
|
- [PubSub](#pubsub)
|
|
- [Audit logs](#audit-logs)
|
|
- [Using custom service accounts for triggers](#using-custom-service-accounts-for-triggers)
|
|
- [Service account](#service-account)
|
|
- [Variables](#variables)
|
|
- [Outputs](#outputs)
|
|
<!-- END TOC -->
|
|
|
|
### IAM and environment variables
|
|
|
|
IAM bindings support the usual syntax. Container environment values can be declared as key-value strings or as references to Secret Manager secrets. Both can be combined as long as there's no duplication of keys:
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = "my-project"
|
|
name = "hello"
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
env = {
|
|
VAR1 = "VALUE1"
|
|
VAR2 = "VALUE2"
|
|
}
|
|
env_from = {
|
|
SECRET1 = {
|
|
name = "credentials"
|
|
key = "1"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
iam = {
|
|
"roles/run.invoker" = ["allUsers"]
|
|
}
|
|
}
|
|
# tftest modules=1 resources=2 inventory=simple.yaml
|
|
```
|
|
|
|
### Mounting secrets as volumes
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = var.project_id
|
|
name = "hello"
|
|
region = var.region
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
volume_mounts = {
|
|
"credentials" = "/credentials"
|
|
}
|
|
}
|
|
}
|
|
volumes = {
|
|
credentials = {
|
|
name = "credentials"
|
|
secret_name = "credentials"
|
|
items = {
|
|
v1 = { path = "v1.txt" }
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=1 inventory=secrets.yaml
|
|
```
|
|
|
|
### Revision annotations
|
|
|
|
Annotations can be specified via the `revision_annotations` variable:
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = var.project_id
|
|
name = "hello"
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
}
|
|
}
|
|
revision_annotations = {
|
|
autoscaling = {
|
|
max_scale = 10
|
|
min_scale = 1
|
|
}
|
|
cloudsql_unstances = ["sql-0", "sql-1"]
|
|
vpcaccess_connector = "foo"
|
|
vpcaccess_egress = "all-traffic"
|
|
}
|
|
}
|
|
# tftest modules=1 resources=1 inventory=revision-annotations.yaml
|
|
```
|
|
|
|
### Second generation execution environment
|
|
|
|
Second generation execution environment (gen2) can be enabled by setting the `gen2_execution_environment` variable to true:
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = var.project_id
|
|
name = "hello"
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
}
|
|
}
|
|
gen2_execution_environment = true
|
|
}
|
|
# tftest modules=1 resources=1 inventory=gen2.yaml
|
|
```
|
|
|
|
### VPC Access Connector creation
|
|
|
|
If creation of a [VPC Access Connector](https://cloud.google.com/vpc/docs/serverless-vpc-access) is required, use the `vpc_connector_create` variable which also support optional attributes for number of instances, machine type, and throughput (not shown here). The annotation to use the connector will be added automatically.
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = var.project_id
|
|
name = "hello"
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
}
|
|
}
|
|
vpc_connector_create = {
|
|
ip_cidr_range = "10.10.10.0/24"
|
|
vpc_self_link = "projects/example/host/global/networks/host"
|
|
}
|
|
}
|
|
# tftest modules=1 resources=2 inventory=connector.yaml
|
|
```
|
|
|
|
Note that if you are using Shared VPC you need to specify a subnet:
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = var.project_id
|
|
name = "hello"
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
}
|
|
}
|
|
vpc_connector_create = {
|
|
subnet = {
|
|
name = "subnet-vpc-access"
|
|
project_id = "host-project"
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=2 inventory=connector-shared.yaml
|
|
```
|
|
|
|
### Traffic split
|
|
|
|
This deploys a Cloud Run service with traffic split between two revisions.
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = "my-project"
|
|
name = "hello"
|
|
revision_name = "green"
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
}
|
|
}
|
|
traffic = {
|
|
blue = { percent = 25 }
|
|
green = { percent = 75 }
|
|
}
|
|
}
|
|
# tftest modules=1 resources=1 inventory=traffic.yaml
|
|
```
|
|
|
|
### Eventarc triggers
|
|
|
|
#### PubSub
|
|
|
|
This deploys a Cloud Run service that will be triggered when messages are published to Pub/Sub topics.
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = "my-project"
|
|
name = "hello"
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
}
|
|
}
|
|
eventarc_triggers = {
|
|
pubsub = {
|
|
topic-1 = "topic1"
|
|
topic-2 = "topic2"
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=3 inventory=eventarc.yaml
|
|
```
|
|
|
|
#### Audit logs
|
|
|
|
This deploys a Cloud Run service that will be triggered when specific log events are written to Google Cloud audit logs.
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = "my-project"
|
|
name = "hello"
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
}
|
|
}
|
|
eventarc_triggers = {
|
|
audit_log = {
|
|
setiampolicy = {
|
|
method = "SetIamPolicy"
|
|
service = "cloudresourcemanager.googleapis.com"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=2 inventory=audit-logs.yaml
|
|
```
|
|
|
|
#### Using custom service accounts for triggers
|
|
|
|
By default `Compute default service account` is used to trigger Cloud Run. If you want to use custom Service Account you can either provide your own in `eventarc_triggers.service_account_email` or set `eventarc_triggers.service_account_create` to true and service account named `tf-cr-trigger-${var.name}` will be created with `roles/run.invoker` granted on this Cloud Run service.
|
|
|
|
Example using provided service account:
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = "my-project"
|
|
name = "hello"
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
}
|
|
}
|
|
eventarc_triggers = {
|
|
audit_log = {
|
|
setiampolicy = {
|
|
method = "SetIamPolicy"
|
|
service = "cloudresourcemanager.googleapis.com"
|
|
}
|
|
}
|
|
service_account_email = "cloud-run-trigger@my-project.iam.gserviceaccount.com"
|
|
}
|
|
}
|
|
# tftest modules=1 resources=2 inventory=trigger-service-account-external.yaml
|
|
```
|
|
|
|
Example using automatically created service account:
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = "my-project"
|
|
name = "hello"
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
}
|
|
}
|
|
eventarc_triggers = {
|
|
pubsub = {
|
|
topic-1 = "topic1"
|
|
topic-2 = "topic2"
|
|
}
|
|
service_account_create = true
|
|
}
|
|
}
|
|
# tftest modules=1 resources=5 inventory=trigger-service-account.yaml
|
|
```
|
|
|
|
### Service account
|
|
|
|
To use a custom service account managed by the module, set `service_account_create` to `true` and leave `service_account` set to `null` value (default).
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = "my-project"
|
|
name = "hello"
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
}
|
|
}
|
|
service_account_create = true
|
|
}
|
|
# tftest modules=1 resources=2 inventory=service-account.yaml
|
|
```
|
|
|
|
To use an externally managed service account, pass its email in `service_account` and leave `service_account_create` to `false` (the default).
|
|
|
|
```hcl
|
|
module "cloud_run" {
|
|
source = "./fabric/modules/cloud-run"
|
|
project_id = "my-project"
|
|
name = "hello"
|
|
containers = {
|
|
hello = {
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
}
|
|
}
|
|
service_account = "cloud-run@my-project.iam.gserviceaccount.com"
|
|
}
|
|
# tftest modules=1 resources=1 inventory=service-account-external.yaml
|
|
```
|
|
<!-- BEGIN TFDOC -->
|
|
## Variables
|
|
|
|
| name | description | type | required | default |
|
|
|---|---|:---:|:---:|:---:|
|
|
| [name](variables.tf#L136) | Name used for cloud run service. | <code>string</code> | ✓ | |
|
|
| [project_id](variables.tf#L151) | Project id used for all resources. | <code>string</code> | ✓ | |
|
|
| [container_concurrency](variables.tf#L18) | Maximum allowed in-flight (concurrent) requests per container of the revision. | <code>string</code> | | <code>null</code> |
|
|
| [containers](variables.tf#L24) | Containers in arbitrary key => attributes format. | <code title="map(object({ image = string args = optional(list(string)) command = optional(list(string)) env = optional(map(string), {}) env_from_key = optional(map(object({ key = string name = string })), {}) liveness_probe = optional(object({ action = object({ grpc = optional(object({ port = optional(number) service = optional(string) })) http_get = optional(object({ http_headers = optional(map(string), {}) path = optional(string) })) }) failure_threshold = optional(number) initial_delay_seconds = optional(number) period_seconds = optional(number) timeout_seconds = optional(number) })) ports = optional(map(object({ container_port = optional(number) name = optional(string) protocol = optional(string) })), {}) resources = optional(object({ limits = optional(object({ cpu = string memory = string })) requests = optional(object({ cpu = string memory = string })) })) startup_probe = optional(object({ action = object({ grpc = optional(object({ port = optional(number) service = optional(string) })) http_get = optional(object({ http_headers = optional(map(string), {}) path = optional(string) })) tcp_socket = optional(object({ port = optional(number) })) }) failure_threshold = optional(number) initial_delay_seconds = optional(number) period_seconds = optional(number) timeout_seconds = optional(number) })) volume_mounts = optional(map(string), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [eventarc_triggers](variables.tf#L91) | Event arc triggers for different sources. | <code title="object({ audit_log = optional(map(object({ method = string service = string })), {}) pubsub = optional(map(string), {}) service_account_email = optional(string) service_account_create = optional(bool, false) })">object({…})</code> | | <code>{}</code> |
|
|
| [gen2_execution_environment](variables.tf#L105) | Use second generation execution environment. | <code>bool</code> | | <code>false</code> |
|
|
| [iam](variables.tf#L111) | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
|
| [ingress_settings](variables.tf#L117) | Ingress settings. | <code>string</code> | | <code>null</code> |
|
|
| [labels](variables.tf#L130) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
|
| [prefix](variables.tf#L141) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
|
| [region](variables.tf#L156) | Region used for all resources. | <code>string</code> | | <code>"europe-west1"</code> |
|
|
| [revision_annotations](variables.tf#L162) | Configure revision template annotations. | <code title="object({ autoscaling = optional(object({ max_scale = number min_scale = number })) cloudsql_instances = optional(list(string), []) vpcaccess_connector = optional(string) vpcaccess_egress = optional(string) })">object({…})</code> | | <code>{}</code> |
|
|
| [revision_name](variables.tf#L177) | Revision name. | <code>string</code> | | <code>null</code> |
|
|
| [service_account](variables.tf#L183) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
|
| [service_account_create](variables.tf#L189) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
|
| [startup_cpu_boost](variables.tf#L195) | Enable startup cpu boost. | <code>bool</code> | | <code>false</code> |
|
|
| [timeout_seconds](variables.tf#L201) | Maximum duration the instance is allowed for responding to a request. | <code>number</code> | | <code>null</code> |
|
|
| [traffic](variables.tf#L207) | Traffic steering configuration. If revision name is null the latest revision will be used. | <code title="map(object({ percent = number latest = optional(bool) tag = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [volumes](variables.tf#L218) | Named volumes in containers in name => attributes format. | <code title="map(object({ secret_name = string default_mode = optional(string) items = optional(map(object({ path = string mode = optional(string) }))) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [vpc_connector_create](variables.tf#L232) | Populate this to create a VPC connector. You can then refer to it in the template annotations. | <code title="object({ ip_cidr_range = optional(string) vpc_self_link = optional(string) machine_type = optional(string) name = optional(string) instances = optional(object({ max = optional(number) min = optional(number) }), {}) throughput = optional(object({ max = optional(number) min = optional(number) }), {}) subnet = optional(object({ name = optional(string) project_id = optional(string) }), {}) })">object({…})</code> | | <code>null</code> |
|
|
|
|
## Outputs
|
|
|
|
| name | description | sensitive |
|
|
|---|---|:---:|
|
|
| [id](outputs.tf#L18) | Fully qualified service id. | |
|
|
| [service](outputs.tf#L23) | Cloud Run service. | |
|
|
| [service_account](outputs.tf#L28) | Service account resource. | |
|
|
| [service_account_email](outputs.tf#L33) | Service account email. | |
|
|
| [service_account_iam_email](outputs.tf#L38) | Service account email. | |
|
|
| [service_name](outputs.tf#L46) | Cloud Run service name. | |
|
|
| [vpc_connector](outputs.tf#L52) | VPC connector resource if created. | |
|
|
<!-- END TFDOC -->
|