Receive Pub/Sub events using an authenticated Cloud Run service

This tutorial shows how to deploy a containerized application using an authenticated Cloud Run service that receives events using Pub/Sub. Pub/Sub is a fully-managed real-time messaging service that lets you send and receive messages between independent applications.

Note: All Cloud Run services are deployed privately by default, which means that they can't be accessed without providing authentication credentials in the request. For projects with domain restricted sharing organization policies, use an authenticated Cloud Run target service rather than one that allows public (unauthenticated) access.

Create an Artifact Registry standard repository

Create an Artifact Registry standard repository to store your container image:

gcloud artifacts repositories create REPOSITORY \
    --repository-format=docker \
    --location=$REGION

Replace REPOSITORY with a unique name for the repository.

Deploy an event receiver to Cloud Run

Deploy a Cloud Run service that logs the contents of an event.

1. Clone the GitHub repository:

   Node.js

   git clone https://github.com/GoogleCloudPlatform/nodejs-docs-samples.git

   Alternatively, you can download the sample as a zip file and extract it.

   Python

   git clone https://github.com/GoogleCloudPlatform/python-docs-samples.git

   Alternatively, you can download the sample as a zip file and extract it.

   Go

   git clone https://github.com/GoogleCloudPlatform/golang-samples.git

   Alternatively, you can download the sample as a zip file and extract it.

   Java

   git clone https://github.com/GoogleCloudPlatform/java-docs-samples.git

   Alternatively, you can download the sample as a zip file and extract it.

   Ruby

   git clone https://github.com/GoogleCloudPlatform/ruby-docs-samples.git

   Alternatively, you can download the sample as a zip file and extract it.

   C#

   git clone https://github.com/GoogleCloudPlatform/dotnet-docs-samples.git

   Alternatively, you can download the sample as a zip file and extract it.

2. Change to the directory that contains the Cloud Run sample code:

   Node.js

   cd nodejs-docs-samples/eventarc/pubsub/

   Python

   cd python-docs-samples/eventarc/pubsub/

   Go

   cd golang-samples/eventarc/pubsub/

   Java

   cd java-docs-samples/eventarc/pubsub/

   Ruby

   cd ruby-docs-samples/eventarc/pubsub/

   C#

   cd dotnet-docs-samples/eventarc/pubsub/

3. Build the container and upload it to Cloud Build:

   gcloud builds submit --tag $REGION-docker.pkg.dev/PROJECT_ID/REPOSITORY/trigger-pubsub:v1

4. Deploy the container image to Cloud Run:

   gcloud run deploy ${SERVICE_NAME} \
       --image $REGION-docker.pkg.dev/PROJECT_ID/REPOSITORY/trigger-pubsub:v1

5. At the Allow unauthenticated invocations to trigger-pubsub (y/N)? prompt, respond n for "No".

Note: Based on the required level of network access to the Cloud Run service, you can also set the ingress flag.

When you see the Cloud Run service URL, the deployment is complete.

Create an Eventarc trigger

When a message is published to the Pub/Sub topic, the event triggers the Cloud Run service.

Note: By default, Pub/Sub subscriptions created for Eventarc persist regardless of activity and don't expire. To change the inactivity duration, see Subscription properties.

1. Create a trigger to listen for Pub/Sub messages:

   New Pub/Sub topic

     gcloud eventarc triggers create ${SERVICE_NAME} \
         --destination-run-service=${SERVICE_NAME} \
         --destination-run-region=${REGION} \
         --location=${REGION} \
         --event-filters="type=google.cloud.pubsub.topic.v1.messagePublished" \
         --service-account=[e-mail]
   

   This creates a new Pub/Sub topic and a trigger for it called trigger-pubsub.

   Existing Pub/Sub topic

     gcloud eventarc triggers create ${SERVICE_NAME} \
         --destination-run-service=${SERVICE_NAME} \
         --destination-run-region=${REGION} \
         --location=${REGION} \
         --event-filters="type=google.cloud.pubsub.topic.v1.messagePublished" \
         --transport-topic=projects/PROJECT_ID/topics/TOPIC_ID \
         --service-account=[e-mail]
   

   Replace the following:

   • PROJECT_ID: your Google Cloud project ID
   • TOPIC_ID: the ID of the existing Pub/Sub topic

   This creates a trigger called trigger-pubsub for the existing Pub/Sub topic.

   Note that when creating an Eventarc trigger for the first time in a Google Cloud project, there might be a delay in provisioning the Eventarc service agent. This issue can usually be resolved by attempting to create the trigger again. For more information, see Permission denied errors.

2. Confirm that the trigger was successfully created. Note that although your trigger is created immediately, it can take up to two minutes for a trigger to be fully functional.

   gcloud eventarc triggers list --location=${REGION}

   The returned trigger status should be ACTIVE: Yes.

Generate and view an event

Publish a message to a Pub/Sub topic to generate an event and trigger the Cloud Run service. The Cloud Run service logs the messages on the service logs.

1. Find and set the Pub/Sub topic as an environment variable:

   export TOPIC_ID=$(gcloud eventarc triggers describe ${SERVICE_NAME} \
       --format='value(transport.pubsub.topic)')

2. Send a message to the Pub/Sub topic to generate an event:

   gcloud pubsub topics publish $TOPIC_ID --message "Hello there"

   The event is sent to the Cloud Run service, which logs the event message.

3. View the event-related log entries created by your service:

   gcloud logging read 'textPayload: "Hello there!"'

   The log entry should be similar to the following:

   textPayload: 'Hello, Hello there!'

Logs might take a few moments to appear. If you don't see them immediately, check again after a minute.