Cloud Run resource

[dazdaz]

Is it possible to launch 'Cloud Run' apps from KCC, I couldn't find a resource for this.

[maqiuyujoyce]

Hi @dazdaz , Config Connector doesn't support Cloud Run resources yet. Thank you for your suggestion! Which Cloud Run resources do you need in your use case? Would be great if you can share more information.

[tedelwartowski-bestbuy]

@maqiuyujoyce - we are also looking to have support for Cloud Run in Config Connector. Out most immediate requirements would be, to create/delete a Cloud Run service (deployment), manage triggers (both ingress and auth - support for beta ingress is a requirement) and set IAM policies on a service. Additionally, we would want to see a method for referencing the Cloud Run service in our NEG (ComputeNetworkEndpointGroup ) configurations.

[jcanseco]

Thanks for the elaborate details @tedelwartowski-bestbuy. I updated the Cloud Run ticket in our backlog with your specific requirements.

manage triggers (both ingress and auth - support for beta ingress is a requirement)

I do need help understanding what you mean by this one -- do you mean you want to be able to manage this resource (and IAM policies for this resource) using Config Connector?

[tedelwartowski-bestbuy]

@jcanseco - I am not that familiar with the API specifically, so I will admit that some of the terminology may be different. When we deploy a Cloud Run service, we now have the option to control how the service is "triggered"; our requirements are that the Cloud Run service must only be allowed to be triggered from Cloud Load Balancing (which is Beta). As part of our automation I would like to see this be part of the Config Connector manifest.

[jcanseco]

Gotcha thanks, I admit I'm not quite the Cloud Run expert :) Let me see if I can check with the right people internally to figure things out.

[jcanseco]

@tedelwartowski-bestbuy, just to clarify, are you referring to this Cloud Run feature?

[tedelwartowski-bestbuy]

@jcanseco - that is correct; in the console these settings are under a tab named Triggers.

[jcanseco]

Great, thanks for confirming!

[Cna59]

Is there an expected date for Cloud Run support in Config Connector?

[jean-baptisteb]

+1

[rskrzypczak-adeo]

+1

[jordanngamba]

+1

[jcanseco]

Hi all, we don't have an ETA yet on this one unfortunately as it is a fairly tricky resource to support. However, we're actively working with the Cloud Run team to get support in Config Connector, and we'll update you all accordingly once we make more progress.

[tgjonestx]

+1

We're trying to provision the Cloud Build Slack Notifier with KCC, but have to resort to a clunky KCC+TF hybrid approach because we can't provision Cloud Run with KCC.

Not sure if this impacts the KCC implementation for Cloud Run or a separate enhancement for PubSub Subscription, but the Cloud Build Slack Notifier also relies on pushConfig endpoint URL based on the URL for the Cloud Run resource. So to close the loop on KCC-managed slack notifier, we also need a way to set the Subscription endpoint URL with the value from the Cloud Run resource

[toumorokoshi]

ack, thank you for noting your additional use case.

We're still talking to the Cloud Run team, but there isn't a clear ETA as we have some inter dependencies that we're discussing currently.

[erik-carlson]

I see that tedelwartowski-bestbuy mentioned being able to set IAM Policies on a cloud run service in his request - I'm wondering if it is possible that this feature would be added separately from support for deploying cloud run resources themselves. So for example we would deploy the cloud run service outside of KCC but be able to grant roles/run.invoker to a user on that service using KCC.

[caieo]

Hi @erik-carlson, When we support Cloud Run, we will also add IAM support for the resource. It looks like the feature/scenario you are asking for can be solved by using the external field in the resource reference. For example, this sample shows how you can connect an IAMPolicyMember to a project that is not managed/deployed by KCC. When we add support for the Cloud Run resource (and subsequently the IAM support for it too), you should be able to also manage external CloudRun resources.

[maqiuyujoyce]

Hi, RunService (alpha) has been released in 1.70.0.

[eda-yuji-10472]

hello
I also want to manage Cloud Run resources using Config Connector. However, I think that it is not suitable for managing Cloud Run, which is an immutable resource, with the current construction. I think it is necessary to cut out Revision as a separate resource in the same way as the version of SecretManager.

[mbzomowski]

Hi @eda-yuji-10472 I'd just like to clarify - with Revision, are you referring to the API described here? And this would coincide with spec.template.revision in RunService in Config Connector?

Also, could you specify what you're trying to do with Cloud Run? Since you mentioned Cloud Run is immutable, are you asking for the corresponding Revision fields in RunService to be mutable or for some kind of mutable Revision resource?

[maqiuyujoyce]

Hi @rafaeltello , the customers are looking into this Cloud Run feature in Config Connector in order to support the CUJ described here. Do you happen to have any idea about the status of it? Is there a potential timeline for it?

[rafaeltello]

Hi @maqiuyujoyce and @tedelwartowski-bestbuy ! Non-public ingress should already be supported in Cloud Run Config Connector: https://github.com/GoogleCloudPlatform/k8s-config-connector/blob/master/crds/run_v1beta1_runservice.yaml#L106
The list of possible values (as string) are specified in https://cloud.google.com/static/run/docs/reference/rest/v2/projects.locations.services#ingresstraffic

[eda-yuji-10472]

Hello, What I would like is the ability to have the revisions themselves managed by the Config Connector. I would like to manage revisions as a separate resource like version control of Secret Manger. 2022年8月10日(水) 2:01 Rafael Tello Cabrales ***@***.***>:

…

Hi @maqiuyujoyce <https://github.com/maqiuyujoyce> ! Non-public ingress should already be supported in Cloud Run Config Connector: https://github.com/GoogleCloudPlatform/k8s-config-connector/blob/master/crds/run_v1beta1_runservice.yaml#L106 The list of possible values (as string) are specified in https://cloud.google.com/static/run/docs/reference/rest/v2/projects.locations.services#ingresstraffic — Reply to this email directly, view it on GitHub <#378 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APZLONU4XRCSBS5FCESX57LVYKFIJANCNFSM4WTFLFUA> . You are receiving this because you were mentioned.Message ID: ***@***.*** com>

[errordeveloper]

Any updates on this? I need Cloud Rub jobs API.

Now that this code is public I had a look, but there is no docs on how to add an API, which is somewhat unfortunate. Perhaps it wouldn't be a trivial change to do properly, but I was hoping maybe I could prototype something.

[maqiuyujoyce]

@errordeveloper thank you for your feedback! Do you mind filing a separate enhancement issue about Cloud Run Job resource?

Now that this code is public I had a look, but there is no docs on how to add an API, which is somewhat unfortunate. Perhaps it wouldn't be a trivial change to do properly, but I was hoping maybe I could prototype something.

Thank you for your willingness to add new KCC resources! Right now, we are still working on the process to accept external contributions, and hopefully can do it some time next year.

[errordeveloper]

@maqiuyujoyce I've opened a new issue here: #732

Thank you for your willingness to add new KCC resources! Right now, we are still working on the process to accept external contributions, and hopefully can do it some time next year.

I was mostly wondering if I could hack something to try in my own environment, I wouldn't neccessarily have the time to see such changes throught in a project that I am not invoved with directly day-to-day, but right now there are no pointers at all that could help me to get started. I think this is a little different from external contributions. However, I do think adding new APIs should be fairly trivial in majority of the cases, if the system offerst the right kind of abstractions, but I a not entirely clear on the design of Config Connect, since there are is no highlevel overview document or anything, all I have figured is that it reliant on Terraform, and that has tripped me up a little also ;)

[diviner524]

@errordeveloper Definitely! We are aware of the missing documentation, which are required before people can understand Config Connector design and contribute to it. This is also something the team is currently working on.

On a related note, we recently updated our set up guide, which shows how to set up a local dev environment and deploy locally built Config Connector in your own K8s dev cluster. It gives a minimal example on how to make a code change and update your cluster to verify the change, hope that will help.

Please give it a try when you get a chance and share your feedbacks!

https://github.com/GoogleCloudPlatform/k8s-config-connector#set-up-your-environment

[errordeveloper]

xref: #732