Skill v1.0.0

currentAutomated scan100/100

jpantsjoha/googlecloud-plugin/cloud-run

──Details

PublishedSeptember 27, 2026 at 05:26 PM

Content Hashsha256:c0ebd2481808fa1a...

Git SHA5546f67e2f07

──Files

Files (1 file, 2.7 KB)

SKILL.md2.7 KBactive

SKILL.md · 75 lines · 2.7 KB

version: "1.0.0" name: cloud-run description: "Deploy and manage containerized workloads on Cloud Run. Covers service creation, traffic splitting, IAM, VPC connectivity, secrets integration, auto-scaling, and gcloud CLI patterns. Warns before billable deployments. Use when the user mentions: deploy to cloud run, create cloud run service, serverless container, scale cloud run, cloud run IAM, cloud run VPC, cloud run secrets, gcloud run." license: MIT metadata: "googlecloud-plugin/version": "0.1" "googlecloud-plugin/triggers": "deploy to cloud run, create cloud run service, cloud run, serverless container, scale cloud run, cloud run IAM, cloud run VPC, cloud run secrets, gcloud run" "googlecloud-plugin/required-scopes": "run.services.create, run.services.delete, run.services.get, run.services.list, run.services.update, run.routes.invoke" "googlecloud-plugin/mcp-servers": "google-cloud-run"

Cloud Run

Deploy and manage containerized applications on Google Cloud Run — fully managed, serverless, and scales to zero.

Prerequisites

gcloud CLI authenticated (gcloud auth login or ADC)
Project set: gcloud config set project PROJECT_ID
APIs enabled: gcloud services enable run.googleapis.com

Core Patterns

Deploy a container

bash

# Billable action — confirm before running
gcloud run deploy SERVICE_NAME \
  --image IMAGE_URI \
  --region REGION \
  --platform managed \
  --no-allow-unauthenticated

Grant invoker access (least-privilege)

bash

gcloud run services add-iam-policy-binding SERVICE_NAME \
  --region REGION \
  --member="serviceAccount:SA@PROJECT.iam.gserviceaccount.com" \
  --role="roles/run.invoker"

VPC connector (private connectivity)

bash

gcloud run services update SERVICE_NAME \
  --vpc-connector CONNECTOR_NAME \
  --region REGION

Mount a secret

bash

gcloud run services update SERVICE_NAME \
  --set-secrets=/path/to/secret=SECRET_NAME:latest \
  --region REGION

Safety Rules

Never use --allow-unauthenticated without explicit intent and gcp-security sign-off
Always specify --no-allow-unauthenticated as the default
Cost warning: Cloud Run bills per request and per CPU/memory allocated — estimate before deploying high-traffic services

References

All versions