googlecloudplatform / terraform-google-cloud-run

Deploys apps to Cloud Run, along with option to map custom domain

Terraform Cloud Run Module

This module handles the basic deployment of containerized applications on Cloud Run, along with domain mapping and IAM policy for the service.

The resources/services/activations/deletions that this module will create/trigger are:

• Creates a Cloud Run service with provided name and container
• Creates Domain mapping for the deployed service
• Applies Cloud Run Invoker role to members

Mapping custom domains and subdomains

You can map multiple custom domains and subdomains to the same Cloud Run service. If you want to register a domain with Cloud Domains, see Registering a domain with Cloud Domains within the Cloud Run console.

To add a custom domain or subdomain to your Cloud Run service, you need to add the values to the verified_domain_name variable.

Before you've mapped your service to a custom domain in Cloud Run, you need to update your DNS records at your domain registry. If you're using Cloud DNS as your DNS provider, see Adding a record.

In case your DNS is not managed by Google Cloud Domains, the ownership of your domain needs to be verified adding a txt record on your DNS configuration. This verification can be done following the steps from this documentation.

Assumptions and Prerequisites

This module assumes that below mentioned prerequisites are in place before consuming the module.

• All required APIs are enabled in the GCP Project
• Cloud SQL (optional)
• VPC Connector (optional)
• Environment Variables in Secret Manager (optional)

Usage

Basic usage of this module is as follows:

module "cloud_run" {
  source  = "GoogleCloudPlatform/cloud-run/google"
  version = "~> 0.10.0"

  # Required variables
  service_name           = "<SERVICE NAME>"
  project_id             = "<PROJECT ID>"
  location               = "<LOCATION>"
  image                  = "gcr.io/cloudrun/hello"
}

Inputs

Name	Description	Type	Default	Required
argument	Arguments passed to the ENTRYPOINT command, include these only if image entrypoint needs arguments	list(string)	[]	no
certificate_mode	The mode of the certificate (NONE or AUTOMATIC)	string	"NONE"	no
container_command	Leave blank to use the ENTRYPOINT command defined in the container image, include these only if image entrypoint should be overwritten	list(string)	[]	no
container_concurrency	Concurrent request limits to the service	number	null	no
domain_map_annotations	Annotations to the domain map	map(string)	{}	no
domain_map_labels	A set of key/value label pairs to assign to the Domain mapping	map(string)	{}	no
encryption_key	CMEK encryption key self-link expected in the format projects/PROJECT/locations/LOCATION/keyRings/KEY-RING/cryptoKeys/CRYPTO-KEY.	string	null	no
env_secret_vars	[Beta] Environment variables (Secret Manager)	list(object({ name = string value_from = set(object({ secret_key_ref = map(string) })) }))	[]	no
env_vars	Environment variables (cleartext)	list(object({ value = string name = string }))	[]	no
force_override	Option to force override existing mapping	bool	false	no
generate_revision_name	Option to enable revision name generation	bool	true	no
image	GCR hosted image URL to deploy	string	n/a	yes
limits	Resource limits to the container	map(string)	null	no
liveness_probe	Periodic probe of container liveness. Container will be restarted if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes	object({ failure_threshold = optional(number, null) initial_delay_seconds = optional(number, null) timeout_seconds = optional(number, null) period_seconds = optional(number, null) http_get = optional(object({ path = optional(string) http_headers = optional(list(object({ name = string value = string })), null) }), null) grpc = optional(object({ port = optional(number) service = optional(string) }), null) })	null	no
location	Cloud Run service deployment location	string	n/a	yes
members	Users/SAs to be given invoker access to the service	list(string)	[]	no
ports	Port which the container listens to (http1 or h2c)	object({ name = string port = number })	{ "name": "http1", "port": 8080 }	no
project_id	The project ID to deploy to	string	n/a	yes
requests	Resource requests to the container	map(string)	{}	no
service_account_email	Service Account email needed for the service	string	""	no
service_annotations	Annotations to the service. Acceptable values all, internal, internal-and-cloud-load-balancing	map(string)	{ "run.googleapis.com/ingress": "all" }	no
service_labels	A set of key/value label pairs to assign to the service	map(string)	{}	no
service_name	The name of the Cloud Run service to create	string	n/a	yes
startup_probe	Startup probe of application within the container. All other probes are disabled if a startup probe is provided, until it succeeds. Container will not be added to service endpoints if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes	object({ failure_threshold = optional(number, null) initial_delay_seconds = optional(number, null) timeout_seconds = optional(number, null) period_seconds = optional(number, null) http_get = optional(object({ path = optional(string) http_headers = optional(list(object({ name = string value = string })), null) }), null) tcp_socket = optional(object({ port = optional(number) }), null) grpc = optional(object({ port = optional(number) service = optional(string) }), null) })	null	no
template_annotations	Annotations to the container metadata including VPC Connector and SQL. See more details	map(string)	{ "autoscaling.knative.dev/maxScale": 2, "autoscaling.knative.dev/minScale": 1, "generated-by": "terraform", "run.googleapis.com/client-name": "terraform" }	no
template_labels	A set of key/value label pairs to assign to the container metadata	map(string)	{}	no
timeout_seconds	Timeout for each request	number	120	no
traffic_split	Managing traffic routing to the service	list(object({ latest_revision = bool percent = number revision_name = string tag = string }))	[ { "latest_revision": true, "percent": 100, "revision_name": "v1-0-0", "tag": null } ]	no
verified_domain_name	List of Custom Domain Name	list(string)	[]	no
volume_mounts	[Beta] Volume Mounts to be attached to the container (when using secret)	list(object({ mount_path = string name = string }))	[]	no
volumes	[Beta] Volumes needed for environment variables (when using secret)	list(object({ name = string secret = set(object({ secret_name = string items = map(string) })) }))	[]	no

Outputs

Name	Description
domain_map_id	Unique Identifier for the created domain map
domain_map_status	Status of Domain mapping
location	Location in which the Cloud Run service was created
project_id	Google Cloud project in which the service was created
revision	Deployed revision for the service
service_id	Unique Identifier for the created service
service_name	Name of the created service
service_status	Status of the created service
service_url	The URL on which the deployed service is available
verified_domain_name	List of Custom Domain Name

Requirements

These sections describe requirements for using this module.

Software

• Terraform ~> v1.3+
• Terraform Provider for GCP < 6
• Terraform Provider for GCP Beta < 6

Service Account

A service account can be used with required roles to execute this module:

• Cloud Run Admin: roles/run.admin

Know more about Cloud Run Deployment Permissions.

The Project Factory module and the IAM module may be used in combination to provision a service account with the necessary roles applied.

APIs

A project with the following APIs enabled must be used to host the main resource of this module:

• Google Cloud Run: run.googleapis.com
• Serverless VPC Access (optional): vpcaccess.googleapis.com
• Cloud SQL (optional): sqladmin.googleapis.com

Contributing

Refer to the contribution guidelines for information on contributing to this module.

terraform-google-cloud-run's Issues

Terraform issue for env vars while creating Cloud run Service

Terraform deployment is failling while creating cloud run service with env_vars for HTTP_PROXY(capital) . If iam using http_proxy it is getting success , but our requirement is to have env var HTTP_PROXY.

However it is allowing us to create env var with HTTP_PROXY in google console, no issue at google end.

Please help us in resolving this issue.

hardcode example

We should try to hardcode as much as possible in examples. For instance
https://github.com/GoogleCloudPlatform/terraform-google-cloud-run/blob/main/examples/simple_cloud_run/main.tf
we can hard code everything except project_id.

How to set security - allow unauthenticated?

------------8<--------------8<------------
Authentication *

Allow unauthenticated invocations
Check this if you are creating a public API or website.

Require authentication
Manage authorized users with Cloud IAM.
------------8<--------------8<------------

It always defaults to "Require authentication"

Standardize variable defaults

We should standardize variable defaults and not have example values like

terraform-google-cloud-run/variables.tf

Line 58 in fe6642a

variable "service_labels" {

terraform-google-cloud-run/variables.tf

Line 75 in fe6642a

variable "template_labels" {

Urgent Query: Usage of volumes and volume_mounts inputs not clear

terraform-google-cloud-run/main.tf

Lines 87 to 102 in 9591595

	dynamic "volumes" {
	for_each = var.volumes
	content {
	name = volumes.value["name"]
	dynamic "secret" {
	for_each = volumes.value.secret
	content {
	secret_name = secret.value["secret_name"]
	items {
	key = secret.value.items["key"]
	path = secret.value.items["path"]
	}
	}
	}
	}
	}

I am using this cloud-run module to create my service. In my use case, I have to mount a secret as a volume.
Following is my code snippet

  env_vars = [
    {
      name  = "CONFIG_FILE"
      value = "/opt/config/service-conf.yaml"
    },
  ]
  volumes =[{
    name = "service-volume"
     secret = [{
      secret_name = google_secret_manager_secret_version.service-conf.id
      items       = {path: "/opt/config/service-conf.yaml", key: "latest"}
    }]
  }]

  volume_mounts = [{
    mount_path = "/opt/config/service-conf.yaml"
    name = "service-volume"
  }]

I didn't find any references to the usage of the above inputs, this is what I derived from the source code.
I would appreciate it if a good usage example is given. Also what values am I putting wrong in the above terraform code?
Awaiting quick response
FYI @proppy @olegshaldybin @dazuma @nikhilk @jskeet

Support for 2nd generation Execution Environment

It would be helpful to allow setting the Cloud Run Execution Environment.

Terraform GCP provider supports the functionality:
https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service#execution_environment

so exposing it in the module should be possible

rule_canary should likely be called rule_rce

Guessing just a typo, this ruleset is specifically addressing Remote Code Execution vulnerabilities. Canary in this context refers to the 'preview' rule set (vs. Stable).

terraform-google-cloud-run/modules/secure-cloud-run-core/variables.tf

Line 55 in 590565d

rule_canary = {

Error with CMEK organization constraint on Serverless VPC connector

When I ran this I got an error as the organization constraint for the virtual machine when running secure-cloud-run-net/network.tf and cloud_run_vpc_connector/network.tf. I adjusted the policy to exception them out....is there a way to apply a CMEK to the instances used in the background

Cloud Run Job missing argument: encryption_key

Hi,
it looks like the encryption_key argument is missing in Cloud Run Job terraform module. Is it possible to add as it was done in Cloud Run Service?

Terraform tries to replace the module.cloud_run.google_cloud_run_domain_mapping.domain_map when reapplying

I face an issue when reapplying TF code for cloud run module where Terraform tries to replace the resource which triggers a downtime because the Google certificate must be reprovisionned.

I am using the latest google provider version at this date (4.59)

 # module.cloud_run.google_cloud_run_domain_mapping.domain_map["XXXXXXXXXXXXXXXXXXXXXX"] must be replaced
-/+ resource "google_cloud_run_domain_mapping" "domain_map" {
      ~ id       = "locations/europe-west1/namespaces/XXXXXXXXXXXXXXXXXXXXXX/domainmappings/XXXXXXXXXXXXXXXXXXXXXX" -> (known after apply)
        name     = "XXXXXXXXXXXXXXXXXXXXXX"
      ~ status   = [
          - {
              - conditions          = [
                  - {
                      - message = ""
                      - reason  = ""
                      - status  = "True"
                      - type    = "Ready"
                    },
                  - {
                      - message = ""
                      - reason  = ""
                      - status  = "True"
                      - type    = "CertificateProvisioned"
                    },
                  - {
                      - message = ""
                      - reason  = ""
                      - status  = "True"
                      - type    = "DomainRoutable"
                    },
                ]
              - mapped_route_name   = "XXXXXXXXXXXXXXXXXXXXXX"
              - observed_generation = 1
              - resource_records    = [
                  - {
                      - name   = "XXXXXXXXXXXXXXXXXXXXXX"
                      - rrdata = "ghs.googlehosted.com."
                      - type   = "CNAME"
                    },
                ]
            },
        ] -> (known after apply)
        # (2 unchanged attributes hidden)

      ~ metadata {
          ~ annotations      = {
              - "run.googleapis.com/operation-id"  = "98643836-60a4-4842-93cc-e701331efcff"
              - "serving.knative.dev/creator"      = "XXXXXXXXXXXXXXXXXXXXXX"
              - "serving.knative.dev/lastModifier" = "XXXXXXXXXXXXXXXXXXXXXX"
            } -> (known after apply) # forces replacement
          ~ generation       = 1 -> (known after apply)
          ~ labels           = {
              - "cloud.googleapis.com/location" = "europe-west1"
              - "run.googleapis.com/overrideAt" = "2023-03-31T19:15:34.884Z"
            } -> (known after apply)
          ~ resource_version = "AAX4N0PSVkY" -> (known after apply)
          ~ self_link        = "/apis/domains.cloudrun.com/v1/namespaces/529599333961/domainmappings/XXXXXXXXXXXXXXXXXXXXXX" -> (known after apply)
          ~ uid              = "937a3f7a-e194-4e6f-b53c-2ae3f816ddbb" -> (known after apply)
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: no

I think this commit tried to fix the issue but the ignore_changes have not been place on every ressource needed.

The ignore change on operation-id should be placed on the ressource google_cloud_run_domain_mapping too.

Add client.knative.dev/nonce to lifecycle ignore_changes

When I run terraform apply after deploying my cloudrun code via gcloud run deploy, even if there are no changes to my terraform config, it shows a diff to client.knative.dev/nonce. Example below:

 ~ template {
          ~ metadata {
              ~ labels      = {
                  - "client.knative.dev/nonce"            = "xyz" -> null
                    # (1 unchanged element hidden)
                }
                # (2 unchanged attributes hidden)
            }

            # (1 unchanged block hidden)
        }

Would it make sense to add this label to the lifeycle ignore_changes? (https://github.com/GoogleCloudPlatform/terraform-google-cloud-run/blob/main/main.tf#L191-L202)

HTTP -> HTTPS redirect using the secure-cloud-run-core module

Hi there,

Is there a way to enable HTTP -> HTTPS redirect using the secure-cloud-run-core module?

Thanks!

Error creating Service: googleapi: Error 403: Google Cloud Run Service Agent does not have permission

Hi,

I am trying to apply the Cloud Run module with the following configuration:

module "cloud_run" {
  source  = "GoogleCloudPlatform/cloud-run/google"
  version = "~> 0.1.1"

  # Required variables
  service_name = "${var.project}-service"
  project_id   = module.project.project_id
  location     = var.region
  image        = "gcr.io/cloudrun/hello"

  depends_on = [google_artifact_registry_repository.docker-registry]
}

But I am getting the following error on applying:

Error creating Service: googleapi: Error 403: Google Cloud Run Service Agent does not have permission to get access tokens for the service account [email protected]. Please give [e-mail] permission iam.serviceAccounts.getAccessToken on the service account. Alternatively, if the service account is unspecified or in the same project you are deploying in, ensure that the Service Agent is assigned the Google Cloud Run Service Agent role roles/run.serviceAgent.
│
│   with module.cloud_run.google_cloud_run_service.main,
│   on .terraform\modules\cloud_run\main.tf line 17, in resource "google_cloud_run_service" "main":
│   17: resource "google_cloud_run_service" "main" {
│
╵

It seems that the service account is being created, but without the Cloud Run Agent role. The module is being applied from the owner user.

There is also another user with same account postfix, but I am not sure exactly why and how it's being created:

Update prereqs

Currently prerequisites include

Cloud SQL
VPC Connector
Environment Variables in Secret Manager

IIUC these are not necessary for core module usage. We can showcase examples using these additional features in examples/. Would be nice to showcase how this works with https://github.com/terraform-google-modules/terraform-google-network/tree/master/modules/vpc-serverless-connector-beta

Unset concurrency and limits cause re-deployment when no changes are made

If the cloud run module is used in a basic fashion, such as:

module "cloud_run" {
  source  = "GoogleCloudPlatform/cloud-run/google"
  version = "~> 0.2.0"

  # Required variables
  service_name           = "my-service"
  project_id             = var.project_id
  location               = var.region
  image                  = "gcr.io/${var.project_id}/my-image"
}

Terraform will always try to update the cloud run resource with a new revision as the default variables for limits and concurrency of "null" are different from the defaults cloud run implements of:

• "cpu" = "1000m"
• "memory" = "512Mi"

Recommend we update default variables to match cloud run defaults to prevent unnecessary redeployment.

Add internal lifecycle for annotations

As the documentation states here : https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_service#annotations

If terraform plan shows a diff where a server-side annotation is added, you can add it to your config or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.

I've deployed my CloudRun service through TF. My CI/CD chain triggers pulls from new latest image.
When I manipulate my TF code, a plan/apply command shows a drift as the annotations are not the same :

  # module.cloud-run-main.google_cloud_run_service.main will be updated in-place
  ~ resource "google_cloud_run_service" "main" {
        id                         = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
        name                       = "xxxxxxxxxxxxxxx-cloudrun"
        # (4 unchanged attributes hidden)

      ~ metadata {
          ~ annotations      = {
              - "client.knative.dev/user-image"     = "xxxxxxxxxxxxxxxxxxxxxxx:latest" -> null
              - "run.googleapis.com/client-name"    = "gcloud" -> null
              - "run.googleapis.com/client-version" = "412.0.0" -> null
              - "run.googleapis.com/operation-id"   = "36e1a984-b8c3-4390-bbd7-927053d1b33e" -> null
                # (4 unchanged elements hidden)
            }
            # (6 unchanged attributes hidden)
        }

      ~ template {
          ~ metadata {
              ~ annotations = {
                  - "client.knative.dev/user-image"           = "xxxxxxxxxxxxxxxxxxxxxx:latest" -> null
                  - "run.googleapis.com/client-name"          = "gcloud" -> null
                  - "run.googleapis.com/client-version"       = "412.0.0" -> null
                    # (5 unchanged elements hidden)
                }
                name        = "xxxxxxxxxxxxxxxxxxxx-cloudrun-00015-yas"
                # (2 unchanged attributes hidden)
            }

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

This is a legit drift that I want to ignore.
Is it possible to add an internal "lifecyle" section in the module ?

I mean, I would like to have some of this code :

module "cloud_run" {
  source  = "GoogleCloudPlatform/cloud-run/google"
  version = "~> 0.2.0"

  # Required variables
  service_name           = "<SERVICE NAME>"
  project_id             = "<PROJECT ID>"
  location               = "<LOCATION>"
  image                  = "gcr.io/cloudrun/hello"

  # Optionnal
  ignore_annotations_changes = true // true or false
}

setup test triggers

To enable tests in this repo, please create a PR similar to example PR

GoogleCloudPlatform/cloud-foundation-toolkit#933

Support for TF Google provider 5.x version

Current release is 5.6

https://github.com/hashicorp/terraform-provider-google/releases

Memory Increase via terraform gets stuck

I have a couple of cloud run services in my terraform project. When i'm trying to increase memory limit, i wait for 10 minutes and the task still doesn't complete.

resource "google_cloud_run_service" "name" {
name = "name"
location = "europe-west2"

traffic {
percent = 100
latest_revision = true
}

lifecycle {
ignore_changes = [
    template["metadata.annotations.client.knative.dev/user-image"],
    template["metadata.annotations.run.googleapis.com/client-name"],
    template["metadata.annotations.run.googleapis.com/client-version"]
]

}

template {
metadata {
annotations = {
"run.googleapis.com/client-name" = "cloud-console"
"autoscaling.knative.${var.project_key}/maxScale" = "1"
"autoscaling.knative.${var.project_key}/minScale" = "1"
"client.knative.${var.project_key}/user-image" = "europe-west2-docker.pkg.dev/${var.project_name}/fname/name:latest"
"run.googleapis.com/cpu-throttling" = "false"
"run.googleapis.com/vpc-access-connector" = "projects/${var.project_name}/locations/${var.region}/connectors/vpc-${var.project_key}-connector"
"run.googleapis.com/vpc-access-egress" = "private-ranges-only"
}
}

spec {
  timeout_seconds = "3600"
  container_concurrency = "10"
  service_account_name = "cloud-run-sa@${var.project_name}.iam.gserviceaccount.com"

  containers {
    image = "europe-west2-docker.pkg.dev/${var.project_name}/name-images/name:latest"

    ports {
      container_port = "8080"
    }

    resources {
      limits = {
        cpu = "1000m"
        memory = "512Mi"
      }
    }
  
  env {
      name ="GCP_BUCKET_NAME"
      value ="${var.bucket_key}"
  }
}

}
}
}

output "name_cloudrun_instance_url" {
value = google_cloud_run_service.name.status[0].url
}

When i run the tf apply i get following changes memory 512mi => 1Gi but it takes 10-12 minutes and the task still doesn't complete.

Any recommendation?

Add suport for selecting Cloud Run generation

There is available gen2 in preview which is not possible to select using this TF templates https://cloud.google.com/run/docs/about-execution-environments

Create additional variable in the cloud run main module

Problem: Currently, template_annotations and some vpc-parameters are being set directly in the secure-cloud-run-core submodule. Because this, the users need to know magic strings like autoscaling.knative.de/maxScale for controlling something as a simple scaling.

Proposal: Adding variables to receive additional parameters for scale, vpc-connector and vpc-egrees in the cloud run main module would be more transparent to the users.

An example can be found on this discussion.

Simplify conditionals

terraform-google-cloud-run/main.tf

Line 80 in fe6642a

service_account_name = var.service_account_name != null ? var.service_account_name : null

can be reduced to service_account_name = var.service_account_name.

nit: we usually prefer service_account_email as that is what the provider usually expects.

fix issues reported by tflint

support for lifecycle ignore_changes

It would be great to add support for ignore_changes on the image parameter.

This would allow to use this module to deploy a cloud run service with a default image and then to use a cloud build to do continuous deployment in this cloud run.

Now if we do that every terraform apply will want to reset to default image. So if we can specify to ignore changes on image parameters it would solve this problem (in this workflow). Terraform have a ignore_changes in lifecycle of resources so we can use this feature.

What do you think?

Cloud Run Module (This) vs GCP Cloud Run Service

Mainly a question, but I'm wondering what the difference is between the GCP provider service and this entirely separate module?

Submodule documentation points to wrong submodule

Submodule documentation points to wrong submodule: https://registry.terraform.io/modules/GoogleCloudPlatform/cloud-run/google/latest/submodules/job-exec

The basic usage block says

```hcl
module "cloud_run_core" {
  source = "GoogleCloudPlatform/cloud-run/google//modules/secure-cloud-run-core"
  version = "~> 0.3.0"

  project_id = var.project_id
  name       = "simple-job"
  location   = "us-central1"
  image      = "us-docker.pkg.dev/cloudrun/container/job"
  exec       = true
}

Getting error during simple cloudrun creation

I am getting error when creating simple cloudrun module

module "service_account" {
source = "terraform-google-modules/service-accounts/google"
version = "~> 4.1.1"
project_id = var.project_id
prefix = "sa-cloud-run"
names = ["simple"]
}

module "cloud-run" {
source = "GoogleCloudPlatform/cloud-run/google"
version = "0.4.0"
service_name = var.service_name
project_id = var.project_id
location = var.location
image = var.image
service_account_email = module.service_account.email
}

module.cloud-run.google_cloud_run_service.main: Creating...
╷
│ Error: Error creating Service: Post "https://-run.googleapis.com/apis/serving.knative.dev/v1/namespaces//services?alt=json": dial tcp: lookup -run.googleapis.com: no such host
│
│ with module.cloud-run.google_cloud_run_service.main,
│ on .terraform/modules/cloud-run/main.tf line 22, in resource "google_cloud_run_service" "main":
│ 22: resource "google_cloud_run_service" "main" {

Please review and provide feedback .

Mapping two subdomains to the same service

Hi guys, viewing the examples I won't find a way to mapping domain and subdomain in the same module

Example: I have enmanuelmoreira.com which mapping to root srv and www mapping as well to root srv, but i am able to mapping just the root domain.

Any help is welcome.

Regards.

Modules are not in sync with latest features from official TF reources

The Cloud Run team produces official terraform resources for all Cloud Run resources. Every GA feature is guaranteed by design and process to be available in the terraform resource, see TF docs

This module is not in sync with the latest features added to Cloud Run. For example: containers should now accept a list of containers.

It is unclear what the value of this module is, compared to the drawbacks of it not capturing all Cloud Run features.

At a minimum, I would suggest to point at the TF resource from this module README. So that users are aware they could directly use the TF resource.

Implement startup_probe configuration

startup_probe is missing as possible inputs in the module.
This prevents some applications to start correctly.

Lifecycle hooks

Wondering what is the need for modifying lifecycle hooks

terraform-google-cloud-run/main.tf

Line 149 in fe6642a

lifecycle {

terraform-google-cloud-run/main.tf

Line 120 in fe6642a

lifecycle {

Add tag support in traffic_split

Terraform has tag attribute under traffic object that seems to be missing from traffic_split of this module

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_service#example-usage---cloud-run-service-add-tag

Getting "Error: Missing container config. " while creating Cloud Run Service using Terraform

Hi Team,
Iam getting below error while creating Cloud Run Service using Terraform. We dont need tag manager for our current requirement. Could you please suggest a way how to resolve this issue with out using CONTAINER_CONFIG environment variable or the container_config command line option.

Error: Missing container config. Please provide the CONTAINER_CONFIG environment variable or the container_config command line option.

Integration tests are failing

Hey folks,

The integration tests are failing. The cause is:

• The examples don't specify an service account to run Cloud Run version/
• The default service account of the project - compute SA is disabled by Project factory when creating the test project.
• Cloud Run is not able to create the service using a disabled service account.

add google-beta provider_meta for attribution

Cloud Run svc and domain mapping seems to use google-beta provider. We should add provider_meta to capture attribution for those resources as well

terraform-google-cloud-run/versions.tf

Line 31 in fe6642a

provider_meta "google" {

example
https://github.com/terraform-google-modules/terraform-google-project-factory/blob/f54adbfb86201069f94e28c14b20a693e3595329/versions.tf#L19-L24

Add 'Secret Accessor' role to Cloud Run service account

In order to use secrets, the Cloud Run service account needs to have the Secret Accessor role:
https://cloud.google.com/run/docs/configuring/secrets#access-secret

Upgrade to support the latest version of hashicorp/google

Currently this blueprint/module requires hashicorp/google ~> 3.53, while 4.6.0 is the latest.

Support for revision tag url.

Cloud run supports tagging a revision to create a unique url for the revision. The url will always point to an exact revision.

The gcloud command for it

gcloud beta run services update --tag=test ....

But I could not find it anywhere in the terraform module. Is it there or am I missing something?

Module use DomainMappings, a preview feature

This module helps users set up a domain while creating Cloud Run services.

The DomainMapping feature of Cloud Run is a preview feature, it will unfortunately not reach GA and we are trying to steer users away from it.

The module should make this clear to users.

Add standard support to CMEK

Add variable to CMEK self-link and configure it in template annotations.

security anti-pattern for VPC Service Controls design: all supported services should be restricted

service_perimeter.tf defines a list of 6 services to restrict, with the option for the user to customize additional_restricted_services. This is a contradiction of Google recommended best practices for VPC service controls.

From Best practices for VPC Service Controls for enterprises...
We recommend that you enable all protected services when you create a perimeter, which helps to reduce complexity and exfiltration vectors. There is no reason to protect one API and not all others,
Stated more explicitly, a VPCSC perimeter that protects only a few services does not protect against data exfiltration, because an insider could use any other GCP service to copy data read by Cloud Run to other services.

Please update the module to include all services supported by VPCSC by default.

Exposing command and args as arrays

Is there a reason behind exposing args and command as string vars vs just exposing the array itself?

terraform-google-cloud-run/main.tf

Lines 33 to 34 in fe6642a

	command = [var.container_command]
	args = [var.argument]

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): Update go modules and/or dev-tools (cft/developer-tools, github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test, go)
• fix(deps)!: Update Terraform GoogleCloudPlatform/lb-http/google to v10
• fix(deps)!: Update Terraform terraform-google-modules/vpc-service-controls/google to v6
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

gomod

test/integration/go.mod

• go 1.21
• go 1.21.6
• github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test v0.13.2
• github.com/stretchr/testify v1.9.0
• github.com/tidwall/gjson v1.17.1

regex

Makefile

• cft/developer-tools 1.19

build/int.cloudbuild.yaml

• cft/developer-tools 1.19

build/lint.cloudbuild.yaml

• cft/developer-tools 1.19

terraform

examples/cloud_run_vpc_connector/main.tf

• GoogleCloudPlatform/cloud-run/google ~> 0.10
• terraform-google-modules/service-accounts/google ~> 4.2

examples/cloud_run_vpc_connector/network.tf

• terraform-google-modules/network/google ~> 9.0
• terraform-google-modules/network/google ~> 9.0

examples/secure_cloud_run/main.tf

• GoogleCloudPlatform/cloud-run/google ~> 0.10

examples/secure_cloud_run_standalone/main.tf

• GoogleCloudPlatform/cloud-run/google ~> 0.10
• GoogleCloudPlatform/cloud-run/google ~> 0.10

examples/simple_cloud_run/main.tf

• GoogleCloudPlatform/cloud-run/google ~> 0.10
• terraform-google-modules/service-accounts/google ~> 4.2

examples/simple_cloud_run_with_cmek/main.tf

• GoogleCloudPlatform/cloud-run/google ~> 0.10
• terraform-google-modules/kms/google ~> 2.1
• terraform-google-modules/service-accounts/google ~> 4.2

examples/simple_job_exec/main.tf

• GoogleCloudPlatform/cloud-run/google ~> 0.10

modules/job-exec/versions.tf

• google < 6
• terracurl ~> 1.0
• hashicorp/terraform >= 0.13

modules/secure-cloud-run-core/loadbalancer.tf

• GoogleCloudPlatform/lb-http/google ~> 6.3

modules/secure-cloud-run-core/main.tf

modules/secure-cloud-run-core/versions.tf

• google < 6
• google-beta < 6
• random < 4.0
• time < 1.0
• hashicorp/terraform >= 0.13

modules/secure-cloud-run-security/kms.tf

• terraform-google-modules/kms/google ~> 2.1

modules/secure-cloud-run-security/org_policies.tf

• terraform-google-modules/org-policy/google ~> 5.1
• terraform-google-modules/org-policy/google ~> 5.1

modules/secure-cloud-run-security/versions.tf

• google < 6
• google-beta < 6
• hashicorp/terraform >= 0.13

modules/secure-cloud-run/main.tf

• terraform-google-modules/project-factory/google ~> 14.0
• terraform-google-modules/project-factory/google ~> 14.0

modules/secure-cloud-run/versions.tf

• google < 6
• google-beta < 6
• hashicorp/terraform >= 0.13

modules/secure-serverless-harness/main.tf

• terraform-google-modules/kms/google ~> 2.2
• terraform-google-modules/project-factory/google ~> 14.2
• terraform-google-modules/project-factory/google ~> 14.2

modules/secure-serverless-harness/network.tf

• terraform-google-modules/network/google ~> 9.0

modules/secure-serverless-harness/private_service_connect.tf

• terraform-google-modules/network/google ~> 9.0

modules/secure-serverless-harness/service_perimeter.tf

• terraform-google-modules/vpc-service-controls/google ~> 5.0
• terraform-google-modules/vpc-service-controls/google ~> 5.0

modules/secure-serverless-harness/versions.tf

• google < 6
• google-beta < 6
• random < 4.0
• time < 1.0
• hashicorp/terraform >= 0.13

modules/secure-serverless-net/firewall.tf

• terraform-google-modules/network/google ~> 9.0

modules/secure-serverless-net/versions.tf

• google < 6
• google-beta < 6
• hashicorp/terraform >= 0.13

modules/service-project-factory/main.tf

• terraform-google-modules/project-factory/google ~> 14.2
• terraform-google-modules/service-accounts/google ~> 4.2

modules/service-project-factory/versions.tf

• google < 6
• google-beta < 6
• random < 4.0
• time < 1.0
• hashicorp/terraform >= 0.13

test/fixtures/secure_cloud_run/harness.tf

• terraform-google-modules/project-factory/google ~> 14.0
• terraform-google-modules/project-factory/google ~> 14.0

test/fixtures/secure_cloud_run/main.tf

test/fixtures/secure_cloud_run/versions.tf

• google >= 3.53
• google-beta >= 3.53
• hashicorp/terraform >= 0.13

test/fixtures/simple_cloud_run/main.tf

test/fixtures/simple_cloud_run/versions.tf

• hashicorp/terraform >= 0.13

test/setup/main.tf

• terraform-google-modules/project-factory/google ~> 14.0

test/setup/versions.tf

• google >= 3.53
• google-beta >= 3.53
• hashicorp/terraform >= 0.13

versions.tf

• google < 6
• google-beta < 6
• hashicorp/terraform >= 1.3

---

• Check this box to trigger a request for Renovate to run again on this repository

Swap allUsers with a list of members

allUsers is potentially dangerous, so we should not make this aa default. We should instead use var.members to allow a list of members access to the service.

dynamic block for ports

Should we be using a dynamic block for ports? There could be cases where ports are unnecessary like Cloud Run triggered via pubsub.

terraform-google-cloud-run/main.tf

Line 36 in fe6642a

ports {

Add a way to disable autocreation of Cloud Armor Security Rule in secure-cloud-run-core

We manage all our Cloud Armor rules at the same place in a centralised way but we want to be able to follow the evolutions of the other part of the module secure-cloud-run-core.

I want to be able to use an already provisioned rule for the load balancer.