Cloud Run Service Chart¶

A Helm chart to template the manifest of a Cloud Run service or job.

name: my-service
image: ghcr.io/my-org/my-image@sha256:abc123
region: us-central1
env: 
  MY_ENV_VAR: my-value
autoscaling: 
  minScale: 0 # scale to zero

name: my-service
image: ghcr.io/my-org/my-image@sha256:abc123
region: us-central1
vpc: 
  network: my-network
  subnetwork: my-subnetwork

name¶

0.1.0 string 63 ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$

Name of the Cloud Run Service to deploy. Must be unique within the project region combination.

name: my-service

project¶

0.1.0 string

The google cloud project to deploy the Cloud Run service to.

project: my-project

region¶

0.1.0 string ^(asia|europe|me|us|africa|australia|northamerica|southamerica)-[a-z]+(\d+)$ us-central1

The region to deploy the CloudRun service to. Uses the default region if not provided.

region: us-central1

region: europe-west1

region: asia-east1

image¶

next object, string

Container image to deploy. You can provide a direct reference to an image using a string or split up the inputs using the object.

image: ghcr.io/my-org/my-image@sha256:abc123

image: 
  repository: ghcr.io/my-project
  name: my-image

image: 
  registry: ghcr.io
  repository: my-project
  name: my-image
  tag: 1.0.0

name¶

0.1.0 string

Container image name.

image:
  name: my-image

registry¶

0.1.0 string

Container image registry.

image:
  registry: gcr.io

repository¶

0.1.0 string

Container image repository.

image:
  repository: gcr.io/my-project

image:
  repository: my-project # if used with a registry

tag¶

0.1.0 string latest

Container image tag.

image:
  tag: latest

image:
  tag: @sha256:abc123

image:
  tag: 1.0.0

revisionName¶

0.1.0 string

The name of the Cloud Run revision to deploy. If not provided, a random name will be generated. The revision will always be prefixed with the service name.

revisionName: my-revision

containerName¶

0.1.0 string

Optional name for the container within a revision. Automatically generated if not supplied.

containerName: my-container

description¶

0.1.0 string

A human-readable description of the CloudRun service.

description: My service does xyz.

env¶

0.1.0 object

Environment variables to set in the CloudRun container. Using an object allows merging of multiple values, e.g. env.staging and env.production.

env: 
  MY_ENV_VAR: my-value

secrets¶

0.1.0 object

Secrets to map as environment variables in the Cloud Run container.

secrets: 
  MY_ENV_VAR: my-secret-name

secrets: 
  MY_ENV_VAR: 
    secret: my-secret-name
    version: 2

secrets: 
  MY_ENV_VAR: 
    secret: another-secret-name
    project: 123456789
    version: 1

secrets: 
  MY_ENV_VAR: 
    secret: another-secret-name
    project: my-project-id
    version: 1

secrets: 
  LOCAL_ENV_VAR: my-secret-name
  CROSS_ENV_VAR: 
    secret: another-secret-name
    project: my-project-id

command¶

0.1.0 array []

Command that runs when the container starts.

command:
  - echo
  - Hello, world!

args¶

0.1.0 array []

Arguments to pass to the command.

args:
  - --help

autoscaling¶

next object

autoscaling: 
  minScale: 1
  maxScale: 100
  maxConcurrentRequests: 80
  timeoutSeconds: 60

autoscaling: 
  minScale: 0
  maxScale: 100
  maxConcurrentRequests: 80
  timeoutSeconds: 120

minScale¶

0.1.0 integer 1

Minimum number of replicas to scale down to. 0 enables scale to zero.

autoscaling:
  minScale: 1

autoscaling:
  minScale: 0

maxScale¶

0.1.0 integer 100

Maximum number of replicas to scale up to.

autoscaling:
  maxScale: 1

maxConcurrentRequests¶

0.1.0 integer 80

The number of concurrent requests per instance. Controls how many requests are processed before the autoscaler scales up. Setting this to 1 means 1 request per instance at a time.

autoscaling:
  maxConcurrentRequests: 1

timeoutSeconds¶

0.1.0 integer 60

The maximum time the container will wait before responding with a 504 error. Especially important for startup times of newly spawned containers.

autoscaling:
  timeoutSeconds: 120

sessionAffinity¶

0.1.0 boolean False

Whether to enable session affinity for the CloudRun service. When enabled, requests from the same client are routed to the same container instance.

sessionAffinity: true

resources¶

0.1.0 object

Resource requests and limits for the CloudRun container. If not provided, defaults are used.

resources: 
  cpuThrottling: true
  startupBoost: false
  limits: 
    cpu: 1
    memory: 512Mi

resources: 
  cpuThrottling: false
  startupBoost: true

resources: 
  limits: 
    cpu: 4
    memory: 8Gi

cpuThrottling¶

0.1.0 boolean True

Whether to throttle the CPU. This has significant impact on billing if set to false.

resources:
  cpuThrottling: false

gpu¶

0.1.0 boolean False

Whether to enable GPU support for the Cloud Run container. Only a single GPU per cloud run container is supported and will incur additional costs.

resources:
  gpu: true

limits¶

0.1.0 object

cpu¶

0.1.0 number 1

Maximum CPUs to allocate for the Cloud Run container.
Can be 1, 2, 4, 6, 8, or any fractional value from 0.08 to less than 1 in increments of 0.01.

The following are minimum memory requirements for CPUs:

resources:
  limits:
    cpu: 0.08

resources:
  limits:
    cpu: 8

memory¶

0.1.0 string ^\d+(\.\d+)?(Mi|Gi)$ 512Mi

Maximum memory to allocate for the Cloud Run container. Must be at least 2GiB for 4 CPUs and 4GiB for 6-8 CPUs.

resources:
  limits:
    memory: 2Gi

resources:
  limits:
    memory: 1024Mi

startupBoost¶

0.1.0 boolean False

Whether to boost the CPUs at the start of the container.

resources:
  startupBoost: false

containerPort¶

0.1.0 integer 8080

Container port to expose. In CloudRun only a single port can be exposed and defaults to 8080.

containerPort: 8081

http2¶

0.1.0 boolean False

Whether to use HTTP/2 for the container port. If enabled, the port name will be h2c instead of http1.

http2: true

ingress¶

0.1.0 string all · internal · internal-and-cloud-load-balancing all

The ingress settings for the CloudRun service. Controls where the service can be accessed from.

ingress: internal

startupProbe¶

0.1.0 object

The startup probe controls how the Cloud Run service is monitored for readiness. And new revisions will only replace the running container if the startup probe succeeds.

startupProbe: 
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 1
  failureThreshold: 3
  httpGet: 
    path: /health
    port: 8080
    httpHeaders:
      -
        name: X-Custom-Header
        value: my-value

startupProbe: 
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 1
  failureThreshold: 3
  tcpSocket: 
    port: 8080

startupProbe: 
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 1
  failureThreshold: 3
  grpc: 
    port: 8080

initialDelaySeconds¶

0.1.0 integer 0

Number of seconds after the container starts before the probe is initiated

periodSeconds¶

0.1.0 integer 10

How often (in seconds) to perform the probe

timeoutSeconds¶

0.1.0 integer 1

Number of seconds after which the probe times out

failureThreshold¶

0.1.0 integer 3

Number of consecutive failures required to determine the container is not alive

startupProbe:
  httpGet: 
    path: /health
    port: 8080
    httpHeaders:
      -
        name: X-Custom-Header
        value: my-value

startupProbe:
  tcpSocket: 
    port: 8080

startupProbe:
  grpc: 
    port: 8080
    service: my-service

livenessProbe¶

0.1.0 object

The liveness probe controls how the Cloud Run service is monitored for health. If a liveness probe does not succeed within the specified time (failureThreshold * periodSeconds), the container is shut down using a SIGKILL signal. Any remaining requests that were still being served by the container are terminated with the HTTP status code 503. After the container is shut down, Cloud Run autoscaling starts up a new container instance.

livenessProbe: 
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 1
  failureThreshold: 3
  httpGet: 
    path: /health
    port: 8080

livenessProbe: 
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 1
  failureThreshold: 3
  grpc: 
    port: 8080

initialDelaySeconds¶

0.1.0 integer 0

Number of seconds after the container starts before the probe is initiated

periodSeconds¶

0.1.0 integer 10

How often (in seconds) to perform the probe

timeoutSeconds¶

0.1.0 integer 1

Number of seconds after which the probe times out

failureThreshold¶

0.1.0 integer 3

Number of consecutive failures required to determine the container is not alive

livenessProbe:
  httpGet: 
    path: /health
    port: 8080
    httpHeaders:
      -
        name: X-Custom-Header
        value: my-value

livenessProbe:
  grpc: 
    port: 8080
    service: my-service

serviceAccountName¶

0.1.0 string

Service account to use to run the CloudRun container. If not provided, the default service account of the project is used.

serviceAccountName: my-service-account@my-project.iam.gserviceaccount.com

labels¶

0.1.0 object

Labels to add to the Cloud Run container. Must conform to the Cloud Run label schema of lowercase alphanumeric characters, hyphens, and underscores and be 63 characters or less.

labels: 
  my-label: my-value

label¶

0.1.0 string 63 ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$

Label key and value must conform to the Cloud Run label schema of lowercase alphanumeric characters, hyphens, and underscores and be 63 characters or less.

volumes¶

0.1.0 object

Volume configurations for the Cloud Run container. Each key is the volume name and must be a valid k8s name (lowercase alphanumeric with dashes).

volumes: 
  config: 
    mountPath: /etc/config
    secret: 
      name: my-secret
      items:
        -
          version: 1
          path: config.json

volumes: 
  cache: 
    mountPath: /cache
    readOnly: false
    emptyDir: 
      sizeLimit: 256Mi
      medium: Memory

volumes: 
  data: 
    mountPath: /data
    gcs: 
      bucket: my-data-bucket
      mountOptions: 
        file-mode: 0644
        dir-mode: 0755

volumes: 
  shared: 
    mountPath: /shared
    nfs: 
      server: 10.0.0.1
      path: /exports/data

volume¶

0.1.0 object ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$

mountPath¶

0.1.0 string ^/.*

Path where the volume should be mounted in the container

volumes:
  volume:
    mountPath: /data

readOnly¶

0.1.0 boolean False

Whether the volume should be mounted read-only

volumes:
  volume:
    readOnly: true

volumes:
  volume:
    secret: 
      name: my-secret
      items:
        -
          path: config.json

volumes:
  volume:
    secret: 
      name: my-secret
      items:
        -
          version: 1
          path: old_key.pem
        -
          version: 2
          path: new_key.pem

volumes:
  volume:
    secret: 
      name: my-secret
      project: my-project
      items:
        -
          version: 1
          path: config.json

volumes:
  volume:
    emptyDir: 
      size: 256Mi

volumes:
  volume:
    gcs: 
      bucket: my-bucket

volumes:
  volume:
    gcs: 
      bucket: my-bucket
      mountOptions: 
        file-mode: 0644
        dir-mode: 0755

volumes:
  volume:
    nfs: 
      server: 10.0.0.1
      path: /exports/data

network¶

0.1.0 object

VPC and networking configuration for the Cloud Run service

network: 
  vpc: my-vpc
  subnetwork: my-subnet
  egress: all-traffic

network: 
  egress: private-ranges-only
  connector: my-connector

network: 
  vpc: projects/other-project/global/networks/my-vpc
  subnetwork: projects/other-project/regions/us-central1/subnetworks/my-subnet
  egress: all-traffic

egress¶

0.1.0 string private-ranges-only · all-traffic private-ranges-only

The egress type to use for the Cloud Run container if connected to a VPC. In general, use private-ranges-only to reduce latency and bottlenecks when calling external services. Can only be set when connector or vpc and subnetwork are set.

network:
  egress: all-traffic

network:
  connector: projects/my-project/locations/us-central1/connectors/my-connector

network:
  connector: my-connector

network:
  vpc: projects/my-project/global/networks/my-vpc

network:
  vpc: my-vpc

network:
  subnetwork: projects/my-project/regions/us-central1/subnetworks/my-subnet

network:
  subnetwork: my-subnet

network:
  tags:
    - tag1
    - tag2

cloudsql¶

0.1.0 object

CloudSQL configuration for the Cloud Run service. If not provided, the service will not be connected to any CloudSQL instances.

cloudsql: 
  instance: my-instance
  project: my-project

cloudsql: 
  instance: my-instance
  project: my-project
  region: europe-west1

instance¶

0.1.0 string

CloudSQL instance name.

cloudsql:
  instance: my-instance

project¶

0.1.0 string

CloudSQL project name.

cloudsql:
  project: my-project

region¶

0.1.0 string .region

CloudSQL region. Defaults to the region of the Cloud Run service.

cloudsql:
  region: us-central1

disableInvokerIamPolicy¶

0.1.0 boolean False

Whether to disable the invoker IAM policy for the Cloud Run service. This is useful when using a VPC connector or direct VPC connection to avoid conflicts with the invoker IAM policy. Must be first requested via invite and is not generally available.

executionEnvironment¶

0.1.0 string gen2 · gen1 gen2

The execution environment to use for the Cloud Run container.

executionEnvironment: gen1

launchStage¶

0.1.0 string ALPHA · BETA · GA BETA

The launch stage of the Cloud Run service. Controls feature availability.

launchStage: GA

binaryAuthorization¶

0.1.0 boolean False

Whether to enforce Binary Authorization policy for this service.

binaryAuthorization: true

encryption¶

0.1.0 object

The KMS key to use for encrypting this service. Must be located in the same region and project as the Cloud Run service.

encryption: 
  key: my-key
  keyring: my-keyring

key¶

0.1.0 string

The KMS key to use for encrypting this service.

keyring¶

0.1.0 string

The KMS keyring where the key is stored.

customAudiences¶

0.1.0 array

Custom audiences to set in the generated ID token when using Identity Platform.

customAudiences:
  - https://example.com
  - my-audience