Google Cloud CloudRun

Google Cloud CloudRun

Certified
Enterprise Edition

Run tasks on Google Cloud Run

Enterprise-only task runner that launches the container image as a Cloud Run Job; requires Cloud Run Developer (roles/run.developer) and Logs Viewer (roles/logging.viewer) roles. Uses a GCS bucket to stage input/namespace files and collect outputs (required when using those features), polls every 5s by default, and times out after 1h unless the task timeout overrides it. The container starts in the root directory (use {{workingDir}} / WORKING_DIR); jobs default to deleting on completion and resuming existing executions when labels match. To generate output files, you can either use the outputFiles task's property and create a file with the same name in the task's working directory, or create any file in the output directory which can be accessed by the {{outputDir}} Pebble expression or the OUTPUT_DIR environment variables.

To use inputFiles, outputFiles, or namespaceFiles properties, make sure to set the bucket property. The bucket serves as an intermediary storage layer for the task runner. Input and namespace files will be uploaded to the cloud storage bucket before the task run. Similarly, the task runner will store outputFiles in this bucket during the task run. In the end, the task runner will make those files available for download and preview from the UI by sending them to internal storage.

The task runner will generate a folder in the configured bucket for each task run. You can access that folder using the {{ bucketPath }} Pebble expression or the BUCKET_PATH environment variable.

Warning: contrary to other task runners, this task runner didn't run the task in the working directory but in the root directory. You must use the {{ workingDir }} Pebble expression or the WORKING_DIR environment variable to access files.

The waitUntilCompletion property maps directly to the GCP "Task timeout" field (visible in the GCP console under Task capacity). It is applied both to the job template and to the per-run override, so the Cloud Run task will be forcibly terminated by GCP when this duration elapses. The Kestra task-level timeout property takes precedence over waitUntilCompletion when set.

Note that when the Kestra Worker running this task is terminated, the Cloud Run Job will still run until completion.

yaml
type: io.kestra.plugin.ee.gcp.runner.CloudRun

Execute a Shell command.

yaml
id: new-shell
namespace: company.team

variables:
  projectId: "projectId"
  region: "europe-west2"

tasks:
  - id: shell
    type: io.kestra.plugin.scripts.shell.Commands
    taskRunner:
      type: io.kestra.plugin.ee.gcp.runner.CloudRun
      projectId: "{{ vars.projectId }}"
      region: "{{ vars.region }}"
      serviceAccount: "{{ secret('GOOGLE_SA') }}"
    commands:
      - echo "Hello World"

Pass input files to the task, execute a Shell command, then retrieve output files.

yaml
id: new-shell-with-file
namespace: company.team

inputs:
  - id: file
    type: FILE

variables:
  projectId: "projectId"
  bucket: "bucket"
  region: "europe-west2"

tasks:
  - id: shell
    type: io.kestra.plugin.scripts.shell.Commands
    inputFiles:
      data.txt: "{{ inputs.file }}"
    outputFiles:
      - out.txt
    containerImage: centos
    taskRunner:
      type: io.kestra.plugin.ee.gcp.runner.CloudRun
      projectId: "{{ vars.projectId }}"
      region: "{{ vars.region }}"
      bucket: "{{ vars.bucket }}"
      serviceAccount: "{{ secret('GOOGLE_SA') }}"
    commands:
      - cp {{ workingDir }}/data.txt {{ workingDir }}/out.txt

Execute a task with Direct VPC Egress.

yaml
id: shell-direct-vpc-egress
namespace: company.team

variables:
  projectId: "projectId"
  region: "europe-west1"
  network: "projects/projectId/global/networks/my-vpc"
  subnetwork: "projects/projectId/regions/europe-west1/subnetworks/my-subnet"

tasks:
  - id: shell
    type: io.kestra.plugin.scripts.shell.Commands
    taskRunner:
      type: io.kestra.plugin.ee.gcp.runner.CloudRun
      projectId: "{{ vars.projectId }}"
      region: "{{ vars.region }}"
      network: "{{ vars.network }}"
      subnetwork: "{{ vars.subnetwork }}"
      vpcEgress: ALL_TRAFFIC
      serviceAccount: "{{ secret('GOOGLE_SA') }}"
    commands:
      - echo "Hello from Direct VPC Egress"

Mount GCS buckets as volumes (read-only or read-write).

yaml
id: shell-with-gcs-volume
namespace: company.team

variables:
  projectId: "projectId"
  region: "europe-west1"

tasks:
  - id: shell
    type: io.kestra.plugin.scripts.shell.Commands
    taskRunner:
      type: io.kestra.plugin.ee.gcp.runner.CloudRun
      projectId: "{{ vars.projectId }}"
      region: "{{ vars.region }}"
      serviceAccount: "{{ secret('GOOGLE_SA') }}"
      volumes:
        - bucket: my-reference-data-bucket
          mountPath: /data
          readOnly: true
        - bucket: my-output-bucket
          mountPath: /output
    commands:
      - ls /data
      - ls /output
Properties

GCP region

Region where the Cloud Run job executes.

Staging GCS bucket

Bucket used to upload input/namespace files and retrieve outputs; required when using file transfer or {{outputDir}}.

DefaultPT5S

Completion poll interval

How often to check execution status; defaults to PT5S. Lower for short jobs, higher to reduce API calls.

Defaulttrue

Delete job after completion

Defaults to true; set false to inspect runs but stale jobs may be reused.

The GCP service account to impersonate

Service account email to impersonate for API calls. For Cloud Run runner, this value applies to API calls used to create and run the job (--impersonate-service-account equivalent). It does not set the job execution identity (--service-account).

Default3

Max Cloud Run retries

Number of execution retries; defaults to 3.

VPC network

VPC network for Direct VPC Egress, for example projects/my-project/global/networks/my-vpc; cannot be used with vpcAccessConnector.

Reference (ref) of the pluginDefaults to apply to this task runner.

The GCP project ID

Container resource limits

CPU and memory limits for the Cloud Run container. If unset, Cloud Run defaults apply.

Definitions
cpustring

CPU limit

CPU limit for the Cloud Run container. Examples: 1, 2, 4, 8 (vCPUs) or 1000m (millicores). See https://cloud.google.com/run/docs/configuring/cpu

memorystring

Memory limit

Memory limit for the Cloud Run container. Examples: 512Mi, 1Gi, 2Gi, 4Gi. See https://cloud.google.com/run/docs/configuring/memory-limits

Defaulttrue

Resume existing job

If true (default), reattach to a matching job instead of creating a new one.

Cloud Run runtime service account

Service account email used as the Cloud Run Job execution identity (--service-account equivalent). This only controls runtime identity for the job's container and does not affect API authentication. If unset, the runner falls back to serviceAccount for backward compatibility.

SubTypestring
Default["https://www.googleapis.com/auth/cloud-platform"]

The GCP scopes to be used

The GCP service account key

Service account JSON key used to authenticate API calls. For Cloud Run runner job execution identity, this value is used as a fallback for --service-account when runtimeServiceAccount is not provided.

VPC subnetwork

VPC subnetwork for Direct VPC Egress, for example projects/my-project/regions/europe-west1/subnetworks/my-subnet; cannot be used with vpcAccessConnector.

Whether to synchronize working directory from remote runner back to local one after run.

Plugin Version

Defines the version of the plugin to use.

The version must follow the Semantic Versioning (SemVer) specification:

  • A single-digit MAJOR version (e.g., 1).
  • A MAJOR.MINOR version (e.g., 1.1).
  • A MAJOR.MINOR.PATCH version, optionally with any qualifier (e.g., 1.1.2, 1.1.0-SNAPSHOT).

Additional GCS bucket volumes

List of GCS buckets to mount as volumes inside the container. Each entry requires a bucket name and a container mount path. Set readOnly: true for read-only access; omit or set readOnly: false (the default) for read-write access.

Definitions
bucket*Requiredstring

GCS bucket name

Name of the Cloud Storage bucket to mount.

mountPath*Requiredstring

Container mount path

Absolute path inside the container where the bucket will be mounted.

readOnlybooleanstring
Defaultfalse

Read-only

If true, the volume is mounted read-only. Defaults to false.

VPC Access Connector

Full resource name for egress connector, e.g. projects/my-project/locations/europe-west1/connectors/my-connector.

Possible Values
VPC_EGRESS_UNSPECIFIEDALL_TRAFFICPRIVATE_RANGES_ONLYUNRECOGNIZED

VPC egress setting

PRIVATE_RANGES_ONLY or ALL_TRAFFIC; requires either vpcAccessConnector, network, or subnetwork.

DefaultPT5S

Post-completion log wait

Quiet period after the job ends: Kestra keeps polling for new log entries until none have arrived for this long, then finalizes logs and outputs; defaults to PT5S.

DefaultPT1H

Task timeout

Maps to the GCP "Task timeout" field visible in the GCP console under Task capacity. Controls both the GCP-enforced task timeout (applied to the job template and the per-run override) and the Kestra polling timeout — the Cloud Run task is forcibly terminated by GCP when this duration elapses. The Kestra task-level timeout property takes precedence over this value when set. Defaults to PT1H. GCP maximum is 168 hours (PT168H).

More Plugins in this Category

Core Plugins and tasks
Core Plugins and tasks

Tasks that provide Kestra's built-in orchestration, I/O, and observability capabilities.

Core

122 tasks

398 blueprints

Liquibase
Liquibase

Tasks that run Liquibase change management commands.

Data

2 tasks