|
|
|
|
@@ -14,6 +14,7 @@ Cloud Run Services and Jobs, with support for IAM roles and Eventarc trigger cre
|
|
|
|
|
- [Eventarc triggers](#eventarc-triggers)
|
|
|
|
|
- [PubSub](#pubsub)
|
|
|
|
|
- [Audit logs](#audit-logs)
|
|
|
|
|
- [GCS bucket](#gcs-bucket)
|
|
|
|
|
- [Using custom service accounts for triggers](#using-custom-service-accounts-for-triggers)
|
|
|
|
|
- [Cloud Run Invoker IAM Disable](#cloud-run-invoker-iam-disable)
|
|
|
|
|
- [Cloud Run Service Account](#cloud-run-service-account)
|
|
|
|
|
@@ -612,6 +613,34 @@ module "cloud_run" {
|
|
|
|
|
# tftest modules=1 resources=4 inventory=service-eventarc-auditlogs-sa-create.yaml
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
### GCS bucket
|
|
|
|
|
|
|
|
|
|
This deploys a Cloud Run service that will be triggered when files are uploaded to a GCS bucket.
|
|
|
|
|
|
|
|
|
|
```hcl
|
|
|
|
|
module "cloud_run" {
|
|
|
|
|
source = "./fabric/modules/cloud-run-v2"
|
|
|
|
|
project_id = var.project_id
|
|
|
|
|
region = var.region
|
|
|
|
|
name = "hello"
|
|
|
|
|
containers = {
|
|
|
|
|
hello = {
|
|
|
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
eventarc_triggers = {
|
|
|
|
|
storage = {
|
|
|
|
|
bucket-upload = {
|
|
|
|
|
bucket = module.gcs.name
|
|
|
|
|
path = "/webhook" # optional: URL path for the Cloud Run service
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
deletion_protection = false
|
|
|
|
|
}
|
|
|
|
|
# tftest modules=2 resources=4 fixtures=fixtures/gcs.tf inventory=service-eventarc-storage.yaml e2e
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
### Using custom service accounts for triggers
|
|
|
|
|
|
|
|
|
|
By default `Compute default service account` is used to trigger Cloud Run. If you want to use custom Service Accounts you can either provide your own in `eventarc_triggers.service_account_email` or set `eventarc_triggers.service_account_create` to true and service account named `tf-cr-trigger-${var.name}` will be created with `roles/run.invoker` granted on this Cloud Run service.
|
|
|
|
|
@@ -666,6 +695,33 @@ module "cloud_run" {
|
|
|
|
|
# tftest modules=2 resources=6 fixtures=fixtures/pubsub.tf inventory=service-eventarc-pubsub-sa-create.yaml e2e
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Example using automatically created service account for storage triggers:
|
|
|
|
|
|
|
|
|
|
```hcl
|
|
|
|
|
module "cloud_run" {
|
|
|
|
|
source = "./fabric/modules/cloud-run-v2"
|
|
|
|
|
project_id = var.project_id
|
|
|
|
|
region = var.region
|
|
|
|
|
name = "hello"
|
|
|
|
|
containers = {
|
|
|
|
|
hello = {
|
|
|
|
|
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
eventarc_triggers = {
|
|
|
|
|
storage = {
|
|
|
|
|
bucket-upload = {
|
|
|
|
|
bucket = module.gcs.name
|
|
|
|
|
path = "/webhook" # optional: URL path for the Cloud Run service
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
service_account_create = true
|
|
|
|
|
}
|
|
|
|
|
deletion_protection = false
|
|
|
|
|
}
|
|
|
|
|
# tftest modules=2 resources=6 fixtures=fixtures/gcs.tf inventory=service-eventarc-storage-sa-create.yaml e2e
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## Cloud Run Invoker IAM Disable
|
|
|
|
|
|
|
|
|
|
To disables IAM permission check for `run.routes.invoke` for callers of this service set the `invoker_iam_disabled` variable of the module to `true` (default `false`). There should be no requirement to pass the `roles/run.invoker` to the IAM block to enable public access. This allows for the org policy `domain restricted sharing` org policy remain enabled.
|
|
|
|
|
@@ -842,28 +898,28 @@ module "cloud_run" {
|
|
|
|
|
|
|
|
|
|
| name | description | type | required | default |
|
|
|
|
|
|---|---|:---:|:---:|:---:|
|
|
|
|
|
| [name](variables.tf#L206) | Name used for Cloud Run service. | <code>string</code> | ✓ | |
|
|
|
|
|
| [project_id](variables.tf#L221) | Project id used for all resources. | <code>string</code> | ✓ | |
|
|
|
|
|
| [region](variables.tf#L226) | Region used for all resources. | <code>string</code> | ✓ | |
|
|
|
|
|
| [name](variables.tf#L210) | Name used for Cloud Run service. | <code>string</code> | ✓ | |
|
|
|
|
|
| [project_id](variables.tf#L225) | Project id used for all resources. | <code>string</code> | ✓ | |
|
|
|
|
|
| [region](variables.tf#L230) | Region used for all resources. | <code>string</code> | ✓ | |
|
|
|
|
|
| [containers](variables.tf#L17) | Containers in name => attributes format. | <code title="map(object({ image = string depends_on = optional(list(string)) command = optional(list(string)) args = optional(list(string)) env = optional(map(string)) env_from_key = optional(map(object({ secret = string version = string }))) liveness_probe = optional(object({ grpc = optional(object({ port = optional(number) service = optional(string) })) http_get = optional(object({ http_headers = optional(map(string)) path = optional(string) port = optional(number) })) failure_threshold = optional(number) initial_delay_seconds = optional(number) period_seconds = optional(number) timeout_seconds = optional(number) })) ports = optional(map(object({ container_port = optional(number) name = optional(string) }))) resources = optional(object({ limits = optional(object({ cpu = string memory = string })) cpu_idle = optional(bool) startup_cpu_boost = optional(bool) })) startup_probe = optional(object({ grpc = optional(object({ port = optional(number) service = optional(string) })) http_get = optional(object({ http_headers = optional(map(string)) path = optional(string) port = optional(number) })) tcp_socket = optional(object({ port = optional(number) })) failure_threshold = optional(number) initial_delay_seconds = optional(number) period_seconds = optional(number) timeout_seconds = optional(number) })) volume_mounts = optional(map(string)) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [create_job](variables.tf#L80) | Create Cloud Run Job instead of Service. | <code>bool</code> | | <code>false</code> |
|
|
|
|
|
| [custom_audiences](variables.tf#L86) | Custom audiences for service. | <code>list(string)</code> | | <code>null</code> |
|
|
|
|
|
| [deletion_protection](variables.tf#L92) | Deletion protection setting for this Cloud Run service. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [encryption_key](variables.tf#L98) | The full resource name of the Cloud KMS CryptoKey. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [eventarc_triggers](variables.tf#L104) | Event arc triggers for different sources. | <code title="object({ audit_log = optional(map(object({ method = string service = string }))) pubsub = optional(map(string)) service_account_email = optional(string) service_account_create = optional(bool, false) })">object({…})</code> | | <code>{}</code> |
|
|
|
|
|
| [iam](variables.tf#L122) | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
|
|
|
|
| [iap_config](variables.tf#L128) | If present, turns on Identity-Aware Proxy (IAP) for the Cloud Run service. | <code title="object({ iam = optional(list(string), []) iam_additive = optional(list(string), []) })">object({…})</code> | | <code>null</code> |
|
|
|
|
|
| [ingress](variables.tf#L153) | Ingress settings. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [invoker_iam_disabled](variables.tf#L170) | Disables IAM permission check for run.routes.invoke for callers of this service. | <code>bool</code> | | <code>false</code> |
|
|
|
|
|
| [labels](variables.tf#L176) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
|
|
|
|
| [launch_stage](variables.tf#L182) | The launch stage as defined by Google Cloud Platform Launch Stages. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [managed_revision](variables.tf#L199) | Whether the Terraform module should control the deployment of revisions. | <code>bool</code> | | <code>true</code> |
|
|
|
|
|
| [prefix](variables.tf#L211) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [revision](variables.tf#L231) | Revision template configurations. | <code title="object({ labels = optional(map(string)) name = optional(string) gen2_execution_environment = optional(bool) max_concurrency = optional(number) max_instance_count = optional(number) min_instance_count = optional(number) job = optional(object({ max_retries = optional(number) task_count = optional(number) }), {}) vpc_access = optional(object({ connector = optional(string) egress = optional(string) network = optional(string) subnet = optional(string) tags = optional(list(string)) }), {}) timeout = optional(string) })">object({…})</code> | | <code>{}</code> |
|
|
|
|
|
| [service_account](variables.tf#L270) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [service_account_create](variables.tf#L276) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
|
|
|
|
| [tag_bindings](variables.tf#L282) | Tag bindings for this service, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
|
|
|
|
| [volumes](variables.tf#L289) | Named volumes in containers in name => attributes format. | <code title="map(object({ secret = optional(object({ name = string default_mode = optional(string) path = optional(string) version = optional(string) mode = optional(string) })) cloud_sql_instances = optional(list(string)) empty_dir_size = optional(string) gcs = optional(object({ bucket = string is_read_only = optional(bool) })) nfs = optional(object({ server = string path = optional(string) is_read_only = optional(bool) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [eventarc_triggers](variables.tf#L104) | Event arc triggers for different sources. | <code title="object({ audit_log = optional(map(object({ method = string service = string }))) pubsub = optional(map(string)) storage = optional(map(object({ bucket = string path = optional(string) }))) service_account_email = optional(string) service_account_create = optional(bool, false) })">object({…})</code> | | <code>{}</code> |
|
|
|
|
|
| [iam](variables.tf#L126) | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
|
|
|
|
| [iap_config](variables.tf#L132) | If present, turns on Identity-Aware Proxy (IAP) for the Cloud Run service. | <code title="object({ iam = optional(list(string), []) iam_additive = optional(list(string), []) })">object({…})</code> | | <code>null</code> |
|
|
|
|
|
| [ingress](variables.tf#L157) | Ingress settings. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [invoker_iam_disabled](variables.tf#L174) | Disables IAM permission check for run.routes.invoke for callers of this service. | <code>bool</code> | | <code>false</code> |
|
|
|
|
|
| [labels](variables.tf#L180) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
|
|
|
|
| [launch_stage](variables.tf#L186) | The launch stage as defined by Google Cloud Platform Launch Stages. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [managed_revision](variables.tf#L203) | Whether the Terraform module should control the deployment of revisions. | <code>bool</code> | | <code>true</code> |
|
|
|
|
|
| [prefix](variables.tf#L215) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [revision](variables.tf#L235) | Revision template configurations. | <code title="object({ labels = optional(map(string)) name = optional(string) gen2_execution_environment = optional(bool) max_concurrency = optional(number) max_instance_count = optional(number) min_instance_count = optional(number) job = optional(object({ max_retries = optional(number) task_count = optional(number) }), {}) vpc_access = optional(object({ connector = optional(string) egress = optional(string) network = optional(string) subnet = optional(string) tags = optional(list(string)) }), {}) timeout = optional(string) })">object({…})</code> | | <code>{}</code> |
|
|
|
|
|
| [service_account](variables.tf#L274) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [service_account_create](variables.tf#L280) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
|
|
|
|
| [tag_bindings](variables.tf#L286) | Tag bindings for this service, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
|
|
|
|
| [volumes](variables.tf#L293) | Named volumes in containers in name => attributes format. | <code title="map(object({ secret = optional(object({ name = string default_mode = optional(string) path = optional(string) version = optional(string) mode = optional(string) })) cloud_sql_instances = optional(list(string)) empty_dir_size = optional(string) gcs = optional(object({ bucket = string is_read_only = optional(bool) })) nfs = optional(object({ server = string path = optional(string) is_read_only = optional(bool) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [vpc_connector_create](variables-vpcconnector.tf#L17) | Populate this to create a Serverless VPC Access connector. | <code title="object({ ip_cidr_range = optional(string) machine_type = optional(string) name = optional(string) network = optional(string) instances = optional(object({ max = optional(number) min = optional(number) }), {} ) throughput = optional(object({ max = optional(number) min = optional(number) }), {} ) subnet = optional(object({ name = optional(string) project_id = optional(string) }), {}) })">object({…})</code> | | <code>null</code> |
|
|
|
|
|
|
|
|
|
|
## Outputs
|
|
|
|
|
@@ -884,6 +940,7 @@ module "cloud_run" {
|
|
|
|
|
## Fixtures
|
|
|
|
|
|
|
|
|
|
- [cloudsql-instance.tf](../../tests/fixtures/cloudsql-instance.tf)
|
|
|
|
|
- [gcs.tf](../../tests/fixtures/gcs.tf)
|
|
|
|
|
- [iam-service-account.tf](../../tests/fixtures/iam-service-account.tf)
|
|
|
|
|
- [pubsub.tf](../../tests/fixtures/pubsub.tf)
|
|
|
|
|
- [secret-credentials.tf](../../tests/fixtures/secret-credentials.tf)
|
|
|
|
|
|
Muhammad Elsaeed