使用 Terraform 建立觸發條件

標準版

本文說明如何使用 Terraform 和 google_eventarc_trigger 資源，為下列 Google Cloud目的地建立 Eventarc 觸發條件：

• Cloud Run
• Google Kubernetes Engine
• Workflows

如要進一步瞭解如何使用 Terraform，請參閱 Terraform on Google Cloud 說明文件。

本指南中的程式碼範例會將 Cloud Storage 的直接事件路由至 flows，但可改編為適用於任何事件供應商。舉例來說，如要瞭解如何將 Pub/Sub 的直接事件傳送至 Cloud Run，請參閱 Terraform 快速入門導覽課程。

事前準備

登入 Google Cloud 帳戶。如果您是 Google Cloud新手，歡迎 建立帳戶，親自評估產品在實際工作環境中的成效。新客戶還能獲得價值 $300 美元的免費抵免額，可用於執行、測試及部署工作負載。

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

1. 啟用 Cloud Resource Manager 和 Identity and Access Management (IAM) API。

   啟用 API 時所需的角色

   如要啟用 API，您必須具備 serviceusage.services.enable 權限。如果您建立了專案，可能已透過「擁有者」角色 (roles/owner) 取得這項權限。否則，您可以透過「服務使用情形管理員」角色 (roles/serviceusage.serviceUsageAdmin) 取得這項權限。瞭解如何授予角色。

   啟用 API

2. 在 Google Cloud 控制台中啟用 Cloud Shell。

   啟用 Cloud Shell

   控制台底部會開啟 Cloud Shell 工作階段，並顯示指令列提示。 Google Cloud Cloud Shell 是已安裝 Google Cloud CLI 的殼層環境，並已針對您目前的專案設定好相關值。工作階段可能要幾秒鐘的時間才能初始化。

3. 在 Cloud Shell 中安裝 Terraform。 如果您使用 Cloud Shell，必須在主目錄或環境中安裝 CLI，才能使用 terraform 指令。

準備部署 Terraform

部署任何 Terraform 資源前，您必須先建立 Terraform 設定檔。您可以使用 Terraform 設定檔，透過 Terraform 語法定義基礎架構的偏好最終狀態。

準備 Cloud Shell

在 Cloud Shell 中，設定要套用 Terraform 設定的預設 Google Cloud 專案。每個專案只需要執行一次這個指令，而且可以在任何目錄中執行：

export GOOGLE_CLOUD_PROJECT=PROJECT_ID

將 PROJECT_ID 替換為 Google Cloud 專案 ID。

請注意，如果您在 Terraform 設定檔中設定明確值，環境變數就會遭到覆寫。

準備目錄

每個 Terraform 設定檔都必須有自己的目錄 (也稱為「根模組」)。在 Cloud Shell 中建立目錄，並在該目錄中建立新檔案：

mkdir DIRECTORY && cd DIRECTORY && touch main.tf

檔名必須有 .tf 副檔名，例如本文件中的檔案稱為 main.tf。

定義 Terraform 設定

將適用的 Terraform 程式碼範例複製到新建立的 main.tf 檔案中。您也可以視需要從 GitHub 複製程式碼。如果 Terraform 程式碼片段是端對端解決方案的一部分，建議使用這個選項。

一般來說，您會一次套用整個設定。不過，您也可以指定特定資源。例如：

terraform apply -target="google_eventarc_trigger.default"

請注意，Terraform 程式碼範例會使用插補進行替換，例如參照變數、資源屬性和呼叫函式。

啟用 API

Terraform 範例通常會假設專案已啟用必要的 API。Google Cloud 請使用下列程式碼啟用 API：

Cloud Run

# Enable Cloud Run API
resource "google_project_service" "run" {
  service            = "run.googleapis.com"
  disable_on_destroy = false
}

# Enable Eventarc API
resource "google_project_service" "eventarc" {
  service            = "eventarc.googleapis.com"
  disable_on_destroy = false
}

# Enable Pub/Sub API
resource "google_project_service" "pubsub" {
  service            = "pubsub.googleapis.com"
  disable_on_destroy = false
}

GKE

# Enable GKE API
resource "google_project_service" "container" {
  service            = "container.googleapis.com"
  disable_on_destroy = false
}

# Enable Eventarc API
resource "google_project_service" "eventarc" {
  service            = "eventarc.googleapis.com"
  disable_on_destroy = false
}

# Enable Pub/Sub API
resource "google_project_service" "pubsub" {
  service            = "pubsub.googleapis.com"
  disable_on_destroy = false
}

工作流程

# Enable Workflows API
resource "google_project_service" "workflows" {
  service            = "workflows.googleapis.com"
  disable_on_destroy = false
}

# Enable Eventarc API
resource "google_project_service" "eventarc" {
  service            = "eventarc.googleapis.com"
  disable_on_destroy = false
}

# Enable Pub/Sub API
resource "google_project_service" "pubsub" {
  service            = "pubsub.googleapis.com"
  disable_on_destroy = false
}

建立服務帳戶並設定存取權

每個 Eventarc 觸發程序都會在建立時，與 IAM 服務帳戶建立關聯。使用下列程式碼建立專屬服務帳戶，並授予使用者代管的服務帳戶特定身分與存取權管理角色，以管理事件：

Cloud Run

# Used to retrieve project information later
data "google_project" "project" {}

# Create a dedicated service account
resource "google_service_account" "default" {
  account_id   = "eventarc-trigger-sa"
  display_name = "Eventarc Trigger Service Account"
}

# Grant permission to receive Eventarc events
resource "google_project_iam_member" "eventreceiver" {
  project = data.google_project.project.id
  role    = "roles/eventarc.eventReceiver"
  member  = "serviceAccount:${google_service_account.default.email}"
}

# Grant permission to invoke Cloud Run services
resource "google_project_iam_member" "runinvoker" {
  project = data.google_project.project.id
  role    = "roles/run.invoker"
  member  = "serviceAccount:${google_service_account.default.email}"
}

啟用 Pub/Sub API 時，系統會自動建立 Pub/Sub 服務代理。如果 Pub/Sub 服務代理程式是在 2021 年 4 月 8 日當天或之前建立，且服務帳戶「沒有」「Cloud Pub/Sub 服務代理程式」角色 (roles/pubsub.serviceAgent)，請將「服務帳戶權杖建立者」角色 (roles/iam.serviceAccountTokenCreator) 授予服務代理程式。詳情請參閱建立服務代理程式並授予角色。

resource "google_project_iam_member" "tokencreator" {
  project  = data.google_project.project.id
  role     = "roles/iam.serviceAccountTokenCreator"
  member   = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-pubsub.iam.gserviceaccount.com"
}

GKE

1. 建立服務帳戶前，請先啟用 Eventarc 來管理 GKE 叢集：

   # Used to retrieve project_number later
   data "google_project" "project" {}
   
   # Enable Eventarc to manage GKE clusters
   # This is usually done with: gcloud eventarc gke-destinations init
   #
   # Eventarc creates a separate Event Forwarder pod for each trigger targeting a
   # GKE service, and  requires explicit permissions to make changes to the
   # cluster. This is done by granting permissions to a special service account
   # (the Eventarc P4SA) to manage resources in the cluster. This needs to be done
   # once per Google Cloud project.
   
   # This identity is created with: gcloud beta services identity create --service eventarc.googleapis.com
   # This local variable is used for convenience
   locals {
     eventarc_sa = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-eventarc.iam.gserviceaccount.com"
   }
   
   resource "google_project_iam_member" "computeViewer" {
     project = data.google_project.project.id
     role    = "roles/compute.viewer"
     member  = local.eventarc_sa
   }
   
   resource "google_project_iam_member" "containerDeveloper" {
     project = data.google_project.project.id
     role    = "roles/container.developer"
     member  = local.eventarc_sa
   }
   
   resource "google_project_iam_member" "serviceAccountAdmin" {
     project = data.google_project.project.id
     role    = "roles/iam.serviceAccountAdmin"
     member  = local.eventarc_sa
   }

2. 建立服務帳戶：

   # Create a service account to be used by GKE trigger
   resource "google_service_account" "eventarc_gke_trigger_sa" {
     account_id   = "eventarc-gke-trigger-sa"
     display_name = "Evenarc GKE Trigger Service Account"
   }
   
   # Grant permission to receive Eventarc events
   resource "google_project_iam_member" "eventreceiver" {
     project = data.google_project.project.id
     role    = "roles/eventarc.eventReceiver"
     member  = "serviceAccount:${google_service_account.eventarc_gke_trigger_sa.email}"
   }
   
   # Grant permission to subscribe to Pub/Sub topics
   resource "google_project_iam_member" "pubsubscriber" {
     project = data.google_project.project.id
     role    = "roles/pubsub.subscriber"
     member  = "serviceAccount:${google_service_account.eventarc_gke_trigger_sa.email}"
   }
   

工作流程

# Used to retrieve project information later
data "google_project" "project" {}

# Create a service account for Eventarc trigger and Workflows
resource "google_service_account" "eventarc" {
  account_id   = "eventarc-workflows-sa"
  display_name = "Eventarc Workflows Service Account"
}

# Grant permission to invoke Workflows
resource "google_project_iam_member" "workflowsinvoker" {
  project = data.google_project.project.id
  role    = "roles/workflows.invoker"
  member  = "serviceAccount:${google_service_account.eventarc.email}"
}

# Grant permission to receive events
resource "google_project_iam_member" "eventreceiver" {
  project = data.google_project.project.id
  role    = "roles/eventarc.eventReceiver"
  member  = "serviceAccount:${google_service_account.eventarc.email}"
}

# Grant permission to write logs
resource "google_project_iam_member" "logwriter" {
  project = data.google_project.project.id
  role    = "roles/logging.logWriter"
  member  = "serviceAccount:${google_service_account.eventarc.email}"
}

啟用 Pub/Sub API 時，系統會自動建立 Pub/Sub 服務代理。如果 Pub/Sub 服務代理程式是在 2021 年 4 月 8 日當天或之前建立，且服務帳戶「沒有」「Cloud Pub/Sub 服務代理程式」角色 (roles/pubsub.serviceAgent)，請將「服務帳戶權杖建立者」角色 (roles/iam.serviceAccountTokenCreator) 授予服務代理程式。詳情請參閱建立服務代理程式並授予角色。

resource "google_project_iam_member" "tokencreator" {
  project  = data.google_project.project.id
  role     = "roles/iam.serviceAccountTokenCreator"
  member   = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-pubsub.iam.gserviceaccount.com"
}

建立 Cloud Storage bucket 做為事件供應商

使用下列程式碼建立 Cloud Storage 值區，並將 Pub/Sub 發布者角色 (roles/pubsub.publisher) 授予 Cloud Storage 服務代理。

Cloud Run

# Cloud Storage bucket names must be globally unique
resource "random_id" "bucket_name_suffix" {
  byte_length = 4
}

# Create a Cloud Storage bucket
resource "google_storage_bucket" "default" {
  name          = "trigger-cloudrun-${data.google_project.project.name}-${random_id.bucket_name_suffix.hex}"
  location      = google_cloud_run_v2_service.default.location
  force_destroy = true

  uniform_bucket_level_access = true
}

# Grant the Cloud Storage service account permission to publish pub/sub topics
data "google_storage_project_service_account" "gcs_account" {}
resource "google_project_iam_member" "pubsubpublisher" {
  project = data.google_project.project.id
  role    = "roles/pubsub.publisher"
  member  = "serviceAccount:${data.google_storage_project_service_account.gcs_account.email_address}"

  depends_on = [data.google_storage_project_service_account.gcs_account]
}

GKE

# Cloud Storage bucket names must be globally unique
resource "random_id" "bucket_name_suffix" {
  byte_length = 4
}

# Create a Cloud Storage bucket
resource "google_storage_bucket" "default" {
  name          = "trigger-gke-${data.google_project.project.name}-${random_id.bucket_name_suffix.hex}"
  location      = "us-central1"
  force_destroy = true

  uniform_bucket_level_access = true
}

# Grant the Cloud Storage service account permission to publish pub/sub topics
data "google_storage_project_service_account" "gcs_account" {}
resource "google_project_iam_member" "pubsubpublisher" {
  project = data.google_project.project.id
  role    = "roles/pubsub.publisher"
  member  = "serviceAccount:${data.google_storage_project_service_account.gcs_account.email_address}"
}

工作流程

# Cloud Storage bucket names must be globally unique
resource "random_id" "bucket_name_suffix" {
  byte_length = 4
}

# Create a Cloud Storage bucket
resource "google_storage_bucket" "default" {
  name          = "trigger-workflows-${data.google_project.project.name}-${random_id.bucket_name_suffix.hex}"
  location      = google_workflows_workflow.default.region
  force_destroy = true

  uniform_bucket_level_access = true
}

# Grant the Cloud Storage service account permission to publish Pub/Sub topics
data "google_storage_project_service_account" "gcs_account" {}
resource "google_project_iam_member" "pubsubpublisher" {
  project = data.google_project.project.id
  role    = "roles/pubsub.publisher"
  member  = "serviceAccount:${data.google_storage_project_service_account.gcs_account.email_address}"
}

建立事件接收器做為事件目標

使用下列任一 Terraform 資源建立事件接收器：

• google_cloud_run_v2_service
• google_container_cluster

• google_workflows_workflow

Cloud Run

建立 Cloud Run 服務，做為 Eventarc 觸發條件的事件目的地：

# Deploy Cloud Run service
resource "google_cloud_run_v2_service" "default" {
  name     = "hello-events"
  location = "us-central1"

  deletion_protection = false # set to "true" in production

  template {
    containers {
      # This container will log received events
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
    service_account = google_service_account.default.email
  }

  depends_on = [google_project_service.run]
}

GKE

為簡化本指南，請在套用 Terraform 設定之間，建立 Google Kubernetes Engine 服務做為 Terraform 外部的事件目的地。

1. 如果您尚未在這個 Google Cloud 專案中建立觸發條件，請執行下列指令來建立 Eventarc 服務代理程式：

   gcloud beta services identity create --service eventarc.googleapis.com

   注意： 所有必要權限可能需要幾分鐘才會套用至 Eventarc 服務代理。如果遇到這個問題，請稍候幾分鐘，然後再次執行 terraform apply。

2. 建立 GKE 叢集：

   # Create an auto-pilot GKE cluster
   resource "google_container_cluster" "gke_cluster" {
     name     = "eventarc-cluster"
     location = "us-central1"
   
     enable_autopilot = true
   
     depends_on = [
       google_project_service.container
     ]
   }

3. 在 GKE 上部署 Kubernetes 服務，使用預先建構的 Cloud Run 映像檔接收 HTTP 要求並記錄事件：us-docker.pkg.dev/cloudrun/container/hello

   1. 取得驗證憑證，與叢集互動：

      gcloud container clusters get-credentials eventarc-cluster \
         --region=us-central1
      

   2. 建立名為 hello-gke 的部署作業：

      kubectl create deployment hello-gke \
         --image=us-docker.pkg.dev/cloudrun/container/hello
      

   3. 將 Deployment 公開為 Kubernetes 服務：

      kubectl expose deployment hello-gke \
         --type ClusterIP --port 80 --target-port 8080
      

   4. 確認 Pod 正在執行：

      kubectl get pods
      

      畫面會顯示如下的輸出內容：

      NAME                         READY   STATUS    RESTARTS   AGE
      hello-gke-5b6574b4db-rzzcr   1/1     Running   0          2m45s
      

      如果 STATUS 為 Pending 或 ContainerCreating，表示 Pod 正在部署中。 等待部署作業完成，然後再次檢查狀態。

   5. 確認服務正在執行：

      kubectl get svc
      

      畫面會顯示如下的輸出內容：

      NAME         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
      hello-gke    ClusterIP   34.118.230.123   <none>        80/TCP    4m46s
      kubernetes   ClusterIP   34.118.224.1     <none>        443/TCP   14m
      

工作流程

部署工作流程，在 Cloud Storage bucket 中的物件更新時執行：

# Create a workflow
resource "google_workflows_workflow" "default" {
  name            = "storage-workflow-tf"
  region          = "us-central1"
  description     = "Workflow that returns information about storage events"
  service_account = google_service_account.eventarc.email

  deletion_protection = false # set to "true" in production

  # Note that $$ is needed for Terraform
  source_contents = <<EOF
  main:
    params: [event]
    steps:
      - log_event:
          call: sys.log
          args:
            text: $${event}
            severity: INFO
      - gather_data:
          assign:
            - bucket: $${event.data.bucket}
            - name: $${event.data.name}
            - message: $${"Received event " + event.type + " - " + bucket + ", " + name}
      - return_data:
          return: $${message}
  EOF

  depends_on = [
    google_project_service.workflows
  ]
}

定義 Eventarc 觸發條件

Eventarc 觸發條件會將事件從事件提供者轉送至事件目的地。使用 google_eventarc_trigger 資源在 matching_criteria 中指定 CloudEvents 屬性，並篩選事件。如需更多資訊，請按照為特定供應商、事件類型和目的地建立觸發條件時的指示操作。 符合所有篩選條件的事件會傳送至目的地。

重要事項：由於 Eventarc Standard 使用 Pub/Sub 做為傳輸層，如果 Cloud Storage 事件來自 Pub/Sub 訊息儲存政策不允許的地區，且強制執行傳輸中作業 ("enforceInTransit": true)，Cloud Storage 觸發條件可能會失敗。在多區域位置建立 Cloud Storage 觸發條件時，請確保訊息儲存政策允許該多區域內的所有來源區域。詳情請參閱「設定訊息儲存政策」。

Cloud Run

建立 Eventarc 觸發條件，將 Cloud Storage 事件轉送至 hello-event Cloud Run 服務。

# Create an Eventarc trigger, routing Cloud Storage events to Cloud Run
resource "google_eventarc_trigger" "default" {
  name     = "trigger-storage-cloudrun-tf"
  location = google_cloud_run_v2_service.default.location

  # Capture objects changed in the bucket
  matching_criteria {
    attribute = "type"
    value     = "google.cloud.storage.object.v1.finalized"
  }
  matching_criteria {
    attribute = "bucket"
    value     = google_storage_bucket.default.name
  }

  # Send events to Cloud Run
  destination {
    cloud_run_service {
      service = google_cloud_run_v2_service.default.name
      region  = google_cloud_run_v2_service.default.location
    }
  }

  # Specify a single delivery attempt with no retries
  retry_policy {
    max_attempts = 1
  }

  service_account = google_service_account.default.email
  depends_on = [
    google_project_service.eventarc,
    google_storage_bucket.default,
    google_project_iam_member.pubsubpublisher
  ]
}

您也可以選擇使用 retry_policy 區塊，指定事件訊息的單一傳遞嘗試，且不重試。唯一有效值為 1。這項限制僅適用於 Cloud Run 目的地 (包括 Cloud Run functions)。如果省略這個區塊，系統會套用標準重試行為。詳情請參閱「重試事件」。

GKE

建立 Eventarc 觸發條件，將 Cloud Storage 事件路由至 hello-gke GKE 服務。

# Create an Eventarc trigger, routing Storage events to GKE
resource "google_eventarc_trigger" "default" {
  name     = "trigger-storage-gke-tf"
  location = "us-central1"

  # Capture objects changed in the bucket
  matching_criteria {
    attribute = "type"
    value     = "google.cloud.storage.object.v1.finalized"
  }
  matching_criteria {
    attribute = "bucket"
    value     = google_storage_bucket.default.name
  }

  # Send events to GKE service
  destination {
    gke {
      cluster   = "eventarc-cluster"
      location  = "us-central1"
      namespace = "default"
      path      = "/"
      service   = "hello-gke"
    }
  }

  service_account = google_service_account.eventarc_gke_trigger_sa.email
}

工作流程

建立 Eventarc 觸發條件，將 Cloud Storage 事件轉送至名為 storage-workflow-tf 的工作流程。

# Create an Eventarc trigger, routing Cloud Storage events to Workflows
resource "google_eventarc_trigger" "default" {
  name     = "trigger-storage-workflows-tf"
  location = google_workflows_workflow.default.region

  # Capture objects changed in the bucket
  matching_criteria {
    attribute = "type"
    value     = "google.cloud.storage.object.v1.finalized"
  }
  matching_criteria {
    attribute = "bucket"
    value     = google_storage_bucket.default.name
  }

  # Send events to Workflows
  destination {
    workflow = google_workflows_workflow.default.id
  }

  service_account = google_service_account.eventarc.email

  depends_on = [
    google_project_service.eventarc,
    google_project_service.workflows,
  ]
}

套用 Terraform

使用 Terraform CLI 根據設定檔佈建基礎架構。

如要瞭解如何套用或移除 Terraform 設定，請參閱「基本 Terraform 指令」。

1. 初始化 Terraform。每個目錄只需執行一次這項操作。

   terraform init

   如要使用最新版 Google 供應商，請加入 -upgrade 選項 (選用)：

   terraform init -upgrade

2. 查看設定，確認 Terraform 即將建立或更新的資源符合預期：

   terraform plan

   視需要修正設定。

3. 執行下列指令，並在提示中輸入 yes，套用 Terraform 設定：

   terraform apply

   等待 Terraform 顯示「Apply complete!」訊息。

確認資源建立作業

Cloud Run

1. 確認服務已建立：

   gcloud run services list --region us-central1
   

2. 確認觸發條件已建立：

   gcloud eventarc triggers list --location us-central1
   

   畫面會顯示如下的輸出內容：

   NAME: trigger-storage-cloudrun-tf
   TYPE: google.cloud.storage.object.v1.finalized
   DESTINATION: Cloud Run service: hello-events
   ACTIVE: Yes
   LOCATION: us-central1
   

GKE

1. 確認服務已建立：

   kubectl get service hello-gke
   

2. 確認觸發條件已建立：

   gcloud eventarc triggers list --location us-central1
   

   畫面會顯示如下的輸出內容：

   NAME: trigger-storage-gke-tf
   TYPE: google.cloud.storage.object.v1.finalized
   DESTINATION: GKE: hello-gke
   ACTIVE: Yes
   LOCATION: us-central1
   

工作流程

1. 確認工作流程已建立：

   gcloud workflows list --location us-central1
   

2. 確認已建立 Eventarc 觸發條件：

   gcloud eventarc triggers list --location us-central1
   

   畫面會顯示如下的輸出內容：

   NAME: trigger-storage-workflows-tf
   TYPE: google.cloud.storage.object.v1.finalized
   DESTINATION: Workflows: storage-workflow-tf
   ACTIVE: Yes
   LOCATION: us-central1
   

產生及查看活動

您可以產生事件，並確認 Eventarc 觸發條件是否正常運作。

注意： 觸發條件會立即建立，但最多需要兩分鐘才會生效並開始篩選事件。

1. 擷取您先前建立的 Cloud Storage bucket 名稱：

   gcloud storage ls
   

2. 將文字檔案上傳至 Cloud Storage bucket：

   echo "Hello World" > random.txt
   gcloud storage cp random.txt gs://BUCKET_NAME/random.txt
   

   將 BUCKET_NAME 替換為您在上一個步驟中擷取的 Cloud Storage bucket 名稱。例如：

   gcloud storage cp random.txt gs://BUCKET_NAME/random.txt

   上傳作業會產生事件，而事件接收器服務會記錄事件的訊息。

3. 確認是否收到事件：

   注意： 如果沒有看到記錄項目，請稍候幾分鐘再重試。

   Cloud Run

   1. 篩選服務建立的記錄項目：

      gcloud logging read 'jsonPayload.message: "Received event of type google.cloud.storage.object.v1.finalized."'
      

   2. 尋找類似下列內容的記錄項目：

      Received event of type google.cloud.storage.object.v1.finalized.
      Event data: { "kind": "storage#object", "id": "trigger-cloudrun-BUCKET_NAME/random.txt", ...}
      

   GKE

   1. 找出 pod ID：

      POD_NAME=$(kubectl get pods -o custom-columns=":metadata.name" --no-headers)
      

      這個指令會使用 kubectl 的格式化輸出。

   2. 檢查 Pod 的記錄：

      kubectl logs $POD_NAME
      

   3. 尋找類似下列內容的記錄項目：

      {"severity":"INFO","eventType":"google.cloud.storage.object.v1.finalized","message":
      "Received event of type google.cloud.storage.object.v1.finalized. Event data: ...}
      

   工作流程

   1. 列出最近五次的執行作業，確認是否已觸發工作流程執行作業：

      gcloud workflows executions list storage-workflow-tf --limit=5
      

      輸出內容應包含執行項目清單，以及 NAME、STATE、START_TIME 和 END_TIME。

   2. 取得最近一次執行的結果：

      EXECUTION_NAME=$(gcloud workflows executions list storage-workflow-tf --limit=1 --format "value(name)")
      gcloud workflows executions describe $EXECUTION_NAME
      

   3. 確認輸出內容類似於下列內容：

      ...
      result: '"Received event google.cloud.storage.object.v1.finalized - BUCKET_NAME, random.txt"'
      startTime: '2024-12-13T17:23:50.451316533Z'
      state: SUCCEEDED
      ...
      

清除所用資源

執行下列指令，並在提示中輸入 yes，即可移除先前透過 Terraform 設定套用的資源：

terraform destroy

您也可以刪除 Google Cloud 專案，以免產生費用。 刪除 Google Cloud 專案後，系統就會停止對專案使用的所有資源收取費用。

注意：刪除專案會造成以下結果：
• 專案中的所有內容都會遭到刪除。如果使用現有專案來進行本文中的任務，刪除專案將一併移除當中已完成的其他任務'。
• 自訂專案 ID 會消失。當您之前建立這個專案時，可能建立了想要在日後使用的自訂專案 ID。如要保留使用該專案 ID 的網址 (例如 appspot.com 網址)，請刪除在該專案中選取的資源，而不是刪除整個專案。
1. 前往 Google Cloud 控制台的「Manage resources」(管理資源) 頁面。

   前往「Manage resources」(管理資源)

2. 在專案清單中選取要刪除的專案，然後點選「Delete」(刪除)。
3. 在對話方塊中輸入專案 ID，然後按一下 [Shut down] (關閉) 以刪除專案。

後續步驟

• 快速入門：使用 Pub/Sub 訊息接收事件 (Terraform)