Google Cloud Function HttpFunction
CertifiedInvoke an authenticated Cloud Run function
Google Cloud Function HttpFunction
Invoke an authenticated Cloud Run function
Calls an HTTP-triggered Cloud Run service using an ID token from the provided service account and returns the response body.
type: io.kestra.plugin.gcp.function.HttpFunctionExamples
id: test_gcp_function
namespace: com.company.test.gcp
tasks:
- id: get_hello_json
type: io.kestra.plugin.gcp.function.HttpFunction
httpMethod: GET
url: https://my-function.europe-west9.run.app
Installation
Our standard Docker images already include this plugin. If you use a -slim image or another setup, install it with the following command:
kestractl plugins get io.kestra.plugin:plugin-gcp --compatible-for $KESTRA_VERSION For kestractl, use your Kestra version with --compatible-for, or specify an exact plugin version.
For Kestra CLI, replace LATEST with a specific version or version range to pin the plugin version.
Properties
httpMethod *string
HTTP method
Rendered verb used for the request (e.g., GET, POST)
url *string
Cloud Run URL
Fully qualified HTTPS URL of the Cloud Run service
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150httpBody object
{}HTTP body
JSON request payload sent to the function; empty by default
impersonatedServiceAccount string
The GCP service account to impersonate
maxDuration string
PT1HMax duration
Maximum wait time for the HTTP call; defaults to 60 minutes
projectId string
The GCP project ID
scopes array
["https://www.googleapis.com/auth/cloud-platform"]The GCP scopes to be used
serviceAccount string
The GCP service account
When unset or rendered to an empty value, Application Default Credentials are used (e.g. GOOGLE_APPLICATION_CREDENTIALS or the runtime's attached identity).
workloadIdentityAudience string
Audience of the Workload Identity Federation provider
The full resource name of the workload identity pool provider, //iam.googleapis.com/projects/<number>/locations/global/workloadIdentityPools/<pool>/providers/<provider>.
Required with workloadIdentityToken, and must match the aud claim of the token.
workloadIdentityToken string
OIDC token for Workload Identity Federation
When set together with workloadIdentityAudience, the token is exchanged at Google STS for federated credentials and no service account key is needed: Google verifies it against the identity provider that issued it.
Use {{ oidcToken(audience='…') }} to have Kestra Enterprise mint one for the running execution.
Combine with impersonatedServiceAccount to act as a service account the pool may impersonate, and set projectId explicitly since no key file carries it.
Cannot be combined with serviceAccount.
Outputs
responseBody object
GCP Function response body
