Deploy a Cloud Run service

This document describes how to use the cloud-run module to deploy a Cloud Run service within Cluster Toolkit blueprints. Use this module to rapidly deploy and manage scalable, containerized applications without provisioning or managing servers.

For the complete list of inputs and outputs for this module, see the cloud-run module page in the Cluster Toolkit GitHub repository.

Before you begin

Before you begin, verify that you have completed the following tasks:

• Enable the Cloud Run API (run.googleapis.com).
• Install the required dependencies to prepare your environment. For instructions, see Install dependencies.

Required roles

To get the permissions that you need to deploy the Cloud Run service, ask your administrator to grant you the following IAM roles on your project:

• Cloud Run Admin (roles/run.admin)
• Project IAM Admin (roles/resourcemanager.projectIamAdmin)

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Note: To set the allow_unauthenticated variable to true, you must have the Project IAM Admin role. The module uses this role to modify IAM policies and grant public access to the service. For more information, see Manage your configuration.

Deploy Cloud Run

The following example demonstrates how to configure a basic Cloud Run service. This configuration deploys a sample container image, sets an environment variable, and configures the service to allow unauthenticated, public traffic.

  - id: cloud_run
    source: modules/compute/cloud-run
    settings:
      project_id: $(vars.project_id)
      region: us-central1
      service_name: my-service
      image: us-docker.pkg.dev/cloudrun/container/hello
      container_port: 8080
      env_vars:
        KEY: "VALUE"
      allow_unauthenticated: true

After the deployment successfully completes, the module outputs the service_url. You can use this URL to directly access your running container.

Manage your configuration

The cloud-run module provides several settings to help you manage your deployment:

• Deletion protection: By default, the deletion_protection variable is set to true. This prevents Terraform from accidentally deleting the service. To let the service be destroyed during a gcluster destroy operation, you must explicitly set this variable to false.
• Ingress traffic: You can restrict the type of network traffic that's allowed to reach your service by setting the ingress variable. By default, the value of this variable is set to INGRESS_TRAFFIC_ALL. If you're deploying internal tools or APIs, then you can restrict access by setting this value to INGRESS_TRAFFIC_INTERNAL_ONLY or INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER.
• Public access: Set the allow_unauthenticated variable to true to make the service publicly accessible. If you leave this variable as false (the default value), then users and services must provide valid authentication credentials to invoke the endpoint.

What's next

• For the complete list of inputs and outputs for this module, see the cloud-run module page in the Cluster Toolkit GitHub repository.