Deploying Cloud Run functions

Exam guide§2.1

Deploying a Cloud Run function hands Google your source code plus configuration, and the platform builds a runnable container image and manages it for you. This page covers who can deploy, the gcloud functions deploy command, where your source can live, and the automatic Cloud Build to Artifact Registry pipeline behind every deploy.

Deployment basics

Deploying a Cloud Run function combines your source code with configuration settings, and the platform builds and manages a runnable container image from them.

You provide source code and configuration settings; Cloud Run functions builds a runnable image and automatically manages it so it can serve requests to your function.

⚠GotchaTwo IAM roles are needed to deploy

A user deploying a Cloud Run function needs the Cloud Functions Developer role (or a role with the same permissions). They must also be granted the Service Account User role on the function's runtime service account - without it the deploy fails even with the Developer role.

You can deploy from the Google Cloud console, using Cloud Build, using Cloud Code, or with the gcloud CLI.

• Cloud Code simplifies development and deployment - IDE plugins that let you create, deploy, and invoke functions directly within your editor.

CommandsDeploy a function with gcloud

gcloud functions deploy YOUR_FUNCTION_NAME \

--gen2 \ # deploy a 2nd-generation function

--region=YOUR_REGION \ # region to deploy into

--runtime=YOUR_RUNTIME \ # language runtime, e.g. python312, nodejs20

--source=YOUR_SOURCE_LOCATION \ # local path, gs:// bucket, or repo reference

--entry-point=YOUR_CODE_ENTRYPOINT \ # function or class name to execute

TRIGGER_FLAGS # trigger type + related config

--entry-point names the function or class in your source that runs when the function is invoked. TRIGGER_FLAGS specify the trigger type and its configuration - see the gcloud functions deploy documentation for the full list.

Where your source code comes from

The --source flag points at one of three locations. All three end at the same built function image.

The --source flag can point at a local directory, a zip in a Cloud Storage bucket, or a source repository reference - all three converge to the same built function image.

≡FactsLocal machine - `--source=/path/...`

• The value is a local file system path to the root directory of the function source code.
• Optionally use --stage-bucket to name a Cloud Storage bucket to upload your source to as part of the deploy.
• Exclude unnecessary files with a .gcloudignore file.

#NumbersCloud Storage - `--source=gs://...`

• The value is the Cloud Storage path to a bucket holding the source packaged as a zip file.
• Source files must be located at the root of the zip file.
• 1st gen: the account performing the deploy needs permission to read from the bucket. 2nd gen: the Cloud Run functions service agent needs read permission on the bucket.

≡FactsSource repository - `--source=https://source.developers.google.com/...`

• The value is a Cloud Source Repositories reference to the source location.
• Deploy a specific revision with revisions/REVISION_NAME in the path; point at a subdirectory with paths/SOURCE_DIRECTORY_PATH.
• The Cloud Run functions service agent must have the Source Repository Reader (roles/source.reader) IAM role on the repository.
• Deploying from Cloud Source Repositories also lets you deploy code hosted in a GitHub or Bitbucket repository.

You can also write and deploy a function directly in the Google Cloud console with the inline editor: a left pane views and selects source files, a right pane edits the selected file.

The build pipeline

On deploy, your function source is stored in Cloud Storage, Cloud Build automatically builds it into a container image and pushes it to Artifact Registry, and Cloud Run functions pulls that image to run your function.

When you deploy, the source is stored in Cloud Storage, then Cloud Build automatically builds it into a container image and pushes that image to Artifact Registry. Cloud Run functions pulls the image when it needs to run your function. The build is entirely automatic and requires no direct input from you.

• Cloud Build executes builds on Google Cloud infrastructure, turning your source into a container image and pushing it to Artifact Registry.
• Artifact Registry is a Google Cloud service that stores and manages software artifacts - container images and language packages - in private repositories. It integrates with Cloud Build and holds your function images.

≡FactsBuild process facts

• All resources in the build execute in your own project.
• The Cloud Build API must be enabled for the project.
• You have access to all build logs through Cloud Logging.