Terraform Cloud Run Module

This module handles the basic deployment of containerized applications on Cloud Run, along with domain mapping and IAM policy for the service.

The resources/services/activations/deletions that this module will create/trigger are:

• Creates a Cloud Run service with provided name and container
• Creates Domain mapping for the deployed service
• Applies Cloud Run Invoker role to members

Mapping custom domains and subdomains

You can map multiple custom domains and subdomains to the same Cloud Run service. If you want to register a domain with Cloud Domains, see Registering a domain with Cloud Domains within the Cloud Run console.

To add a custom domain or subdomain to your Cloud Run service, you need to add the values to the verified_domain_name variable.

Before you've mapped your service to a custom domain in Cloud Run, you need to update your DNS records at your domain registry. If you're using Cloud DNS as your DNS provider, see Adding a record.

In case your DNS is not managed by Google Cloud Domains, the ownership of your domain needs to be verified adding a txt record on your DNS configuration. This verification can be done following the steps from this documentation.

Assumptions and Prerequisites

This module assumes that below mentioned prerequisites are in place before consuming the module.

• All required APIs are enabled in the GCP Project
• Cloud SQL (optional)
• VPC Connector (optional)
• Environment Variables in Secret Manager (optional)

Usage

Basic usage of this module is as follows:

module "cloud_run" {
  source  = "GoogleCloudPlatform/cloud-run/google"
  version = "~> 0.10.0"

  # Required variables
  service_name           = "<SERVICE NAME>"
  project_id             = "<PROJECT ID>"
  location               = "<LOCATION>"
  image                  = "gcr.io/cloudrun/hello"
}

Inputs

list(object({
    name = string
    value_from = set(object({
      secret_key_ref = map(string)
    }))
  }))

list(object({
    value = string
    name  = string
  }))

object({
    failure_threshold     = optional(number, null)
    initial_delay_seconds = optional(number, null)
    timeout_seconds       = optional(number, null)
    period_seconds        = optional(number, null)
    http_get = optional(object({
      path = optional(string)
      http_headers = optional(list(object({
        name  = string
        value = string
      })), null)
    }), null)
    grpc = optional(object({
      port    = optional(number)
      service = optional(string)
    }), null)
  })

object({
    name = string
    port = number
  })

{
  "name": "http1",
  "port": 8080
}

{
  "run.googleapis.com/ingress": "all"
}

object({
    failure_threshold     = optional(number, null)
    initial_delay_seconds = optional(number, null)
    timeout_seconds       = optional(number, null)
    period_seconds        = optional(number, null)
    http_get = optional(object({
      path = optional(string)
      http_headers = optional(list(object({
        name  = string
        value = string
      })), null)
    }), null)
    tcp_socket = optional(object({
      port = optional(number)
    }), null)
    grpc = optional(object({
      port    = optional(number)
      service = optional(string)
    }), null)
  })

{
  "autoscaling.knative.dev/maxScale": 2,
  "autoscaling.knative.dev/minScale": 1,
  "generated-by": "terraform",
  "run.googleapis.com/client-name": "terraform"
}

list(object({
    latest_revision = bool
    percent         = number
    revision_name   = string
    tag             = string
  }))

[
  {
    "latest_revision": true,
    "percent": 100,
    "revision_name": "v1-0-0",
    "tag": null
  }
]

list(object({
    mount_path = string
    name       = string
  }))

list(object({
    name = string
    secret = set(object({
      secret_name = string
      items       = map(string)
    }))
  }))

Outputs

Requirements

These sections describe requirements for using this module.

Software

• Terraform ~> v1.3+
• Terraform Provider for GCP < 6
• Terraform Provider for GCP Beta < 6

Service Account

A service account can be used with required roles to execute this module:

• Cloud Run Admin: roles/run.admin

Know more about Cloud Run Deployment Permissions.

The Project Factory module and the IAM module may be used in combination to provision a service account with the necessary roles applied.

APIs

A project with the following APIs enabled must be used to host the main resource of this module:

• Google Cloud Run: run.googleapis.com
• Serverless VPC Access (optional): vpcaccess.googleapis.com
• Cloud SQL (optional): sqladmin.googleapis.com

Contributing

Refer to the contribution guidelines for information on contributing to this module.