Cannot deploy public api on Cloud Run using Terraform

Question

Terraform now supports cloud run as documented here, and I'm trying the example code below.

resource "google_cloud_run_service" "default" {
  name     = "tftest-cloudrun"
  location = "us-central1"
  provider = "google-beta"

  metadata {
    namespace = "my-project-name"
  }

  spec {
    containers {
      image = "gcr.io/cloudrun/hello"
    }
  }
}

Although it deploys the sample hello service with no error, when I access to the auto-generated URL, it returns 403(Forbidden) response. Is it possible to create public cloud run api using terraform?

(When I'm creating the same service using GUI, GCP provides "Allow unauthenticated invocations" option under "Authentication" section, but there seems to be no equivalent option in terraform document...)

Answer 1

Just add the following code to your terraform script, which will make it publicly accessable

data "google_iam_policy" "noauth" {
  binding {
    role = "roles/run.invoker"
    members = [
      "allUsers",
    ]
  }
}

resource "google_cloud_run_service_iam_policy" "noauth" {
  location    = google_cloud_run_service.default.location
  project     = google_cloud_run_service.default.project
  service     = google_cloud_run_service.default.name

  policy_data = data.google_iam_policy.noauth.policy_data
}

You can also find this here

Answer 2

Here the deployment is only based on Knative serving spec. Cloud Run managed implements these specs but have its own internal behavior, like role check linked with IAM (not possible with Knative and a K8S cluster, this is replaced by Private/Public service). The namespace on Cloud Run managed is the projectId, a workaround to identify the project for example, not a real K8S namespace.

So, the latest news that I have from Google (I'm Cloud Run Alpha Tester) which tells they are working with Deployment Manager and Terraform for integrating Cloud Run in them. I don't have deadline, sorry.