cloud-foundation-fabric/modules/cloud-run-v2

Cloud Run Module

Cloud Run management, with support for IAM roles and Eventarc trigger creation.

Examples

• Examples
  • IAM and environment variables
  • Mounting secrets as volumes
  • Beta features
  • VPC Access Connector
  • Eventarc triggers
    • PubSub
    • Audit logs
    • Using custom service accounts for triggers
  • Cloud Run Service Account
• Variables
• Outputs

IAM and environment variables

IAM bindings support the usual syntax. Container environment values can be declared as key-value strings or as references to Secret Manager secrets. Both can be combined as long as there is no duplication of keys:

module "cloud_run" {
  source     = "./fabric/modules/cloud-run-v2"
  project_id = var.project_id
  name       = "hello"
  region     = var.region
  containers = {
    hello = {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
      env = {
        VAR1 = "VALUE1"
        VAR2 = "VALUE2"
      }
      env_from_key = {
        SECRET1 = {
          secret  = "credentials"
          version = "1"
        }
      }
    }
  }
  iam = {
    "roles/run.invoker" = ["allUsers"]
  }
}
# tftest modules=1 resources=2

Mounting secrets as volumes

module "cloud_run" {
  source     = "./fabric/modules/cloud-run-v2"
  project_id = var.project_id
  name       = "hello"
  region     = var.region
  containers = {
    hello = {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
      volume_mounts = {
        "credentials" = "/credentials"
      }
    }
  }
  volumes = {
    credentials = {
      secret = {
        name = "secret-manager-id"
        path = "my-secret"
      }
    }
  }
}
# tftest modules=1 resources=1 

Beta features

To use beta features like Direct VPC Egress, set the launch stage to a preview stage.

module "cloud_run" {
  source       = "./fabric/modules/cloud-run-v2"
  project_id   = var.project_id
  name         = "hello"
  region       = var.region
  launch_stage = "BETA"
  containers = {
    hello = {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }
  revision = {
    gen2_execution_environment = true
    max_instance_count         = 20
    vpc_access = {
      egress = "ALL_TRAFFIC"
      subnet = "default"
      tags   = ["tag1", "tag2", "tag3"]
    }
  }
}
# tftest modules=1 resources=1 

VPC Access Connector

You can use an existing VPC Access Connector to connect to a VPC from Cloud Run.

module "cloud_run" {
  source     = "./fabric/modules/cloud-run-v2"
  project_id = var.project_id
  name       = "hello"
  containers = {
    hello = {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }
  revision = {
    vpc_access = {
      connector = "connector-id"
      egress    = "ALL_TRAFFIC"
    }
  }
}
# tftest modules=1 resources=1 

If creation of the VPC Access Connector is required, use the vpc_connector_create variable which also supports optional attributes like number of instances, machine type, or throughput. The connector will be used automatically.

module "cloud_run" {
  source     = "./fabric/modules/cloud-run-v2"
  project_id = var.project_id
  name       = "hello"
  containers = {
    hello = {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }
  vpc_connector_create = {
    ip_cidr_range = "10.10.10.0/24"
    vpc_self_link = "projects/example/global/networks/vpc"
    instances = {
      max = 10
      min = 2
    }
  }
}
# tftest modules=1 resources=2 

Note that if you are using a Shared VPC for the connector, you need to specify a subnet and the host project if this is not where the Cloud Run service is deployed.

module "cloud_run" {
  source     = "./fabric/modules/cloud-run-v2"
  project_id = var.project_id
  name       = "hello"
  containers = {
    hello = {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }
  vpc_connector_create = {
    machine_type = "e2-standard-4"
    subnet = {
      name       = "subnet-name"
      project_id = "host-project"
    }
  }
}
# tftest modules=1 resources=2 

Eventarc triggers

PubSub

This deploys a Cloud Run service that will be triggered when messages are published to Pub/Sub topics.

module "cloud_run" {
  source     = "./fabric/modules/cloud-run-v2"
  project_id = var.project_id
  name       = "hello"
  containers = {
    hello = {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }
  eventarc_triggers = {
    pubsub = {
      topic-1 = "topic1"
      topic-2 = "topic2"
    }
  }
}
# tftest modules=1 resources=3 

Audit logs

This deploys a Cloud Run service that will be triggered when specific log events are written to Google Cloud audit logs.

module "cloud_run" {
  source     = "./fabric/modules/cloud-run-v2"
  project_id = var.project_id
  name       = "hello"
  containers = {
    hello = {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }
  eventarc_triggers = {
    audit_log = {
      setiampolicy = {
        method  = "SetIamPolicy"
        service = "cloudresourcemanager.googleapis.com"
      }
    }
  }
}
# tftest modules=1 resources=2 

Using custom service accounts for triggers

By default Compute default service account is used to trigger Cloud Run. If you want to use custom Service Accounts you can either provide your own in eventarc_triggers.service_account_email or set eventarc_triggers.service_account_create to true and service account named tf-cr-trigger-${var.name} will be created with roles/run.invoker granted on this Cloud Run service.

Example using provided service account:

module "cloud_run" {
  source     = "./fabric/modules/cloud-run-v2"
  project_id = var.project_id
  name       = "hello"
  containers = {
    hello = {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }
  eventarc_triggers = {
    audit_log = {
      setiampolicy = {
        method  = "SetIamPolicy"
        service = "cloudresourcemanager.googleapis.com"
      }
    }
    service_account_email = "cloud-run-trigger@my-project.iam.gserviceaccount.com"
  }
}
# tftest modules=1 resources=2 

Example using automatically created service account:

module "cloud_run" {
  source     = "./fabric/modules/cloud-run-v2"
  project_id = var.project_id
  name       = "hello"
  containers = {
    hello = {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }
  eventarc_triggers = {
    pubsub = {
      topic-1 = "topic1"
      topic-2 = "topic2"
    }
    service_account_create = true
  }
}
# tftest modules=1 resources=5 

Cloud Run Service Account

To use a custom service account managed by the module, set service_account_create to true and leave service_account set to null (default).

module "cloud_run" {
  source     = "./fabric/modules/cloud-run-v2"
  project_id = var.project_id
  name       = "hello"
  containers = {
    hello = {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }
  service_account_create = true
}
# tftest modules=1 resources=2 

To use an externally managed service account, use its email in service_account and leave service_account_create to false (default).

module "cloud_run" {
  source     = "./fabric/modules/cloud-run-v2"
  project_id = var.project_id
  name       = "hello"
  containers = {
    hello = {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }
  service_account = "cloud-run@my-project.iam.gserviceaccount.com"
}
# tftest modules=1 resources=1

Variables

name	description	type	required	default
name	Name used for Cloud Run service.	string	✓
project_id	Project id used for all resources.	string	✓
containers	Containers in name => attributes format.	map(object({…}))		{}
eventarc_triggers	Event arc triggers for different sources.	object({…})		{}
iam	IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format.	map(list(string))		{}
ingress	Ingress settings.	string		null
labels	Resource labels.	map(string)		{}
launch_stage	The launch stage as defined by Google Cloud Platform Launch Stages.	string		null
prefix	Optional prefix used for resource names.	string		null
region	Region used for all resources.	string		"europe-west1"
revision	Revision template configurations.	object({…})		{}
service_account	Service account email. Unused if service account is auto-created.	string		null
service_account_create	Auto-create service account.	bool		false
volumes	Named volumes in containers in name => attributes format.	map(object({…}))		{}
vpc_connector_create	Populate this to create a Serverless VPC Access connector.	object({…})		null

Outputs

name	description	sensitive
id	Fully qualified service id.
service	Cloud Run service.
service_account	Service account resource.
service_account_email	Service account email.
service_account_iam_email	Service account email.
service_name	Cloud Run service name.
vpc_connector	VPC connector resource if created.