Google Cloud Run infrastructure
Create Harness environments and Google Cloud Run infrastructure definitions to target your GCP project for deployment.
An infrastructure definition links your logical Harness environment to the actual physical resources: the GCP project and region where Harness deploys your Cloud Run service. You create the environment and infrastructure definition at Deployments > Environments and reuse them across pipelines and stages.
What you will learn
How to create a Harness environment for Google Cloud Run.
How to configure an infrastructure definition with a GCP connector and region.
The GCP authentication methods supported and the IAM permissions required.
How to reuse infrastructure definitions across pipelines and stages.
Before you begin
A GCP project with Cloud Run enabled.
A Harness GCP connector configured with one of the supported authentication methods. Go to GCP authentication to configure one.
IAM permissions on the GCP service account or identity. Go to Cloud Run permissions to review the minimum required permissions.
Create an environment
You can create an environment from Deployments > Environments, or inline during stage configuration at step 3 (Configure environments) of the stage wizard.
When configuring a stage, step 3 presents two options:
Environment: deploy to one or more environments.
Environment group: deploy to a pre-configured group of environments.
Select Environment, then use the Create or select environment field to create a new environment or pick an existing one. Enable the Deploy environments in parallel toggle if you are deploying to multiple environments and want them to run concurrently.
To create a standalone environment:
Go to Deployments, expand the drop-down, and select Environments.
Click + New Environment.
Enter a name and select an environment type: Pre-Production or Production.
Click Save.
Create an infrastructure definition
Infrastructure definitions live inside an environment. Each definition targets a specific GCP project and region.
Open the environment and select the Infrastructure Definitions tab.
Click + Create Infrastructure.
In the Create Infrastructure dialog, select Google Cloud Run and click Save.
Configure the following in the infrastructure definition form:
Top-level fields
Name
The infrastructure definition name. Harness auto-suggests an ID that you can edit.
Storage
Inline (Harness stores the definition) or a Git repository.
Cluster details: Provisioner configuration
Expand Cluster Details and then Provisioner Configuration to configure the target GCP environment:
Connector
Yes
A Harness GCP connector that authenticates with GCP. Click Create or select connector to create a new one or pick an existing connector.
Project
Yes
The GCP project to deploy to. This is a searchable dropdown populated from the connector. You can select any project the connector has access to, including projects different from the connector's default project.
Region
Yes
The region where Cloud Run will run the service (for example, us-central1 or asia).
Simultaneous deployments
Simultaneous deployments
False
By default, Harness queues deployments to the same infrastructure to avoid conflicts. Set to True to allow multiple deployments to run concurrently against the same infrastructure.
Additional sections
Scope to Specific Services: restrict this infrastructure definition so it is only available to selected services.
Metadata: add tags and other metadata to the infrastructure definition.
Click Save.
GCP authentication
Harness supports three authentication methods for GCP connectors used with Cloud Run deployments.
Service account
Provide a GCP service account JSON key. Harness activates the key using gcloud auth activate-service-account before running deployment commands.
To create a GCP connector with a service account key:
Go to Account Settings > Connectors and click + New Connector.
Select GCP under Cloud Providers.
Select Specify credentials here and upload or paste the service account JSON key.
Complete the connector setup and click Save and Continue.
OIDC
Use OpenID Connect to authenticate without storing a service account key in Harness. Harness exchanges an OIDC token for GCP credentials using a Workload Identity Pool.
To create a GCP OIDC connector:
Go to Account Settings > Connectors and click + New Connector.
Select GCP under Cloud Providers.
Select Use OpenID Connect (OIDC).
Provide the Workload Identity Pool ID, Workload Provider ID, GCP project ID, and the service account email to impersonate.
Complete the connector setup and click Save and Continue.
The OIDC service account must have the iam.workloadIdentityPools.createCredentialConfig permission and iam.serviceAccounts.actAs on the Cloud Run service identity.
Inherit from delegate
Use the GCP credentials of the node where the delegate is running. This is suited for delegates deployed on GKE with Workload Identity or on GCE with an attached service account. At runtime, Harness runs gcloud auth list --filter=status:ACTIVE to identify the active service account on the delegate node, then uses Application Default Credentials for all subsequent operations.
To create a GCP connector that inherits from the delegate:
Go to Account Settings > Connectors and click + New Connector.
Select GCP under Cloud Providers.
Select Use the credentials of a specific Harness Delegate.
Select the delegate tag and complete the connector setup.
Plugin version for Inherit from Delegate
When using Inherit from Delegate, use plugin image version 1.0.4 or later. Earlier versions fail when the gcloud CLI outputs extra messages (update notifications, survey prompts) alongside the account list. Go to Google Cloud Run services for the current image reference.
Cloud Run permissions
The following IAM permissions are required on the GCP service account or identity used for deployment.
Minimum permissions
The table below lists the minimum permissions required for each operation:
List and describe services
run.services.list, run.services.get
Deploy or update a service
run.services.create, run.services.update
Delete a service (first-deployment rollback)
run.services.delete
Manage jobs
run.jobs.create, run.jobs.update, run.jobs.get, run.jobs.run
Invoke a service
run.routes.invoke
Instance sync and post-deploy verification
monitoring.timeSeries.list, monitoring.metricDescriptors.list
View configuration
run.configurations.list, run.configurations.get
Manage IAM policies
resourcemanager.projects.getIamPolicy, resourcemanager.projects.setIamPolicy
OIDC authentication
iam.workloadIdentityPools.createCredentialConfig
Service account key authentication
iam.serviceAccounts.get, iam.serviceAccounts.signBlob
Service account impersonation
iam.serviceAccounts.actAs (required on the Cloud Run service identity, even when the deployer and service identity are the same account)
Predefined roles
The following predefined roles can be used instead of individual permissions:
roles/run.admin (Cloud Run Admin)
Full administrative access to manage Cloud Run services. Required for deploying services.
roles/iam.serviceAccountUser (Service Account User)
Permission to use service accounts for running Cloud Run services. Required even when the deployer and Cloud Run service identity are the same account.
roles/logging.viewer (Logging Viewer)
Access to logs for debugging Cloud Run services.
roles/monitoring.viewer (Monitoring Viewer)
Required for post-deploy instance verification. Without this role, the deploy step succeeds but then fails with a PermissionDenied error during verification.
roles/iam.workloadIdentityPoolAdmin (IAM Workload Identity Pool Admin)
Required for OIDC authentication setup.
Next steps
Go to Deployment strategies to configure your pipeline execution strategy.
Go to Google Cloud Run services to configure the service manifest and artifact source.
Last updated
Was this helpful?