<commit_before>---
# ----------------------------------------------------------------------------
#
#     ***     AUTO GENERATED CODE    ***    Type: MMv1     ***
#
# ----------------------------------------------------------------------------
#
#     This file is automatically generated by Magic Modules and manual
#     changes will be clobbered when the file is regenerated.
#
#     Please read more about how to change this file in
#     .github/CONTRIBUTING.md.
#
# ----------------------------------------------------------------------------
subcategory: "Cloud Run"
layout: "google"
page_title: "Google: google_cloud_run_service"
sidebar_current: "docs-google-cloud-run-service"
description: |-
  Service acts as a top-level container that manages a set of Routes and
  Configurations which implement a network service.
---

# google\_cloud\_run\_service

Service acts as a top-level container that manages a set of Routes and
Configurations which implement a network service. Service exists to provide a
singular abstraction which can be access controlled, reasoned about, and
which encapsulates software lifecycle decisions such as rollout policy and
team resource ownership. Service acts only as an orchestrator of the
underlying Routes and Configurations (much as a kubernetes Deployment
orchestrates ReplicaSets).

The Service's controller will track the statuses of its owned Configuration
and Route, reflecting their statuses and conditions as its own.

See also:
https://github.com/knative/serving/blob/master/docs/spec/overview.md#service


To get more information about Service, see:

* [API documentation](https://cloud.google.com/run/docs/reference/rest/v1/namespaces.services)
* How-to Guides
    * [Official Documentation](https://cloud.google.com/run/docs/)

~> **Warning:** `google_cloudrun_service` creates a Managed Google Cloud Run Service. If you need to create
a Cloud Run Service on Anthos(GKE/VMWare) then you will need to create it using the kubernetes alpha provider.
Have a look at the Cloud Run Anthos example below.

## Example Usage - Cloud Run Service Basic


```hcl
resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/hello"
      }
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
}
```
<div class = "oics-button" style="float: right; margin: 0 0 -15px">
  <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=cloud_run_service_sql&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
    <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
  </a>
</div>
## Example Usage - Cloud Run Service Sql


```hcl
resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/hello"
      }
    }

    metadata {
      annotations = {
        "autoscaling.knative.dev/maxScale"      = "1000"
        "run.googleapis.com/cloudsql-instances" = google_sql_database_instance.instance.connection_name
        "run.googleapis.com/client-name"        = "terraform"
      }
    }
  }
  autogenerate_revision_name = true
}

resource "google_sql_database_instance" "instance" {
  name             = "cloudrun-sql"
  region           = "us-east1"
  database_version = "MYSQL_5_7"
  settings {
    tier = "db-f1-micro"
  }

  deletion_protection  = "true"
}
```
## Example Usage - Cloud Run Service Noauth


```hcl
resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/hello"
      }
    }
  }
}

data "google_iam_policy" "noauth" {
  binding {
    role = "roles/run.invoker"
    members = [
      "allUsers",
    ]
  }
}

resource "google_cloud_run_service_iam_policy" "noauth" {
  location    = google_cloud_run_service.default.location
  project     = google_cloud_run_service.default.project
  service     = google_cloud_run_service.default.name

  policy_data = data.google_iam_policy.noauth.policy_data
}
```
## Example Usage - Cloud Run Anthos


```hcl
data "google_client_config" "provider" {}

data "google_container_cluster" "my_cluster" {
  name     = "cluster-1"
  location = "us-central1-c"
}

provider "kubernetes-alpha" {
  host  = "https://${data.google_container_cluster.my_cluster.endpoint}"
  token = data.google_client_config.provider.access_token
  cluster_ca_certificate = base64decode(
    data.google_container_cluster.my_cluster.master_auth.0.cluster_ca_certificate,
  )
}

resource "kubernetes_manifest" "test-configmap" {
  provider = kubernetes-alpha

  manifest = {
    "apiVersion" = "serving.knative.dev/v1"
    "kind"       = "Service"
    "metadata" = {
      "name"      = "helloworld-go"
      "namespace" = "default"
    }
    "spec" = {
      "template" = {
        "spec" = {
          "containers" = [
            {
              "image" = "us-docker.pkg.dev/cloudrun/container/hello"
            }
          ]
        }
      }
    }
  }
}
```
## Example Usage - Cloud Run Service Multiple Environment Variables


```hcl
resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/hello"
        env {
          name = "SOURCE"
          value = "remote"
        }
        env {
          name = "TARGET"
          value = "home"
        }
      }
    }
  }

  metadata {
    annotations = {
      generated-by = "magic-modules"
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
  autogenerate_revision_name = true

  lifecycle {
    ignore_changes = [
        metadata.0.annotations,
    ]
  }
}
```
## Example Usage - Cloud Run Service Traffic Split


```hcl
resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/hello"
      }
    }
    metadata {
      name = "cloudrun-srv-green"
    }
  }

  traffic {
    percent       = 25
    revision_name = "cloudrun-srv-green"
  }

  traffic {
    percent       = 75
    # This revision needs to already exist
    revision_name = "cloudrun-srv-blue"
  }
}
```
## Example Usage - Cloud Run Service Secret Environment Variables


```hcl
data "google_project" "project" {
}

resource "google_secret_manager_secret" "secret" {
  secret_id = "secret"
  replication {
    automatic = true
  }
}

resource "google_secret_manager_secret_version" "secret-version-data" {
  secret = google_secret_manager_secret.secret.name
  secret_data = "secret-data"
}

resource "google_secret_manager_secret_iam_member" "secret-access" {
  secret_id = google_secret_manager_secret.secret.id
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${data.google_project.project.number}-<EMAIL>"
  depends_on = [google_secret_manager_secret.secret]
}

resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "gcr.io/cloudrun/hello"
        env {
          name = "SECRET_ENV_VAR"
	  value_from {
            secret_key_ref {
              name = google_secret_manager_secret.secret.secret_id
              key = "1"
            }
          }
        }
      }
    }
  }

  metadata {
    annotations = {
      generated-by = "magic-modules"
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
  autogenerate_revision_name = true

  lifecycle {
    ignore_changes = [
        metadata.0.annotations,
    ]
  }

  depends_on = [google_secret_manager_secret_version.secret-version-data]
}
```
## Example Usage - Cloud Run Service Secret Volumes


```hcl
data "google_project" "project" {
}

resource "google_secret_manager_secret" "secret" {
  secret_id = "secret"
  replication {
    automatic = true
  }
}

resource "google_secret_manager_secret_version" "secret-version-data" {
  secret = google_secret_manager_secret.secret.name
  secret_data = "secret-data"
}

resource "google_secret_manager_secret_iam_member" "secret-access" {
  secret_id = google_secret_manager_secret.secret.id
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${data.google_project.project.number}-<EMAIL>"
  depends_on = [google_secret_manager_secret.secret]
}

resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "gcr.io/cloudrun/hello"
	volume_mounts {
	  name = "a-volume"
	  mount_path = "/secrets"
	}
      }
      volumes {
        name = "a-volume"
	secret {
	  secret_name = google_secret_manager_secret.secret.secret_id
	  items {
            key = "1"
	    path = "my-secret"
	  }
	}
      }
    }
  }

  metadata {
    annotations = {
      generated-by = "magic-modules"
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
  autogenerate_revision_name = true

  lifecycle {
    ignore_changes = [
        metadata.0.annotations,
    ]
  }

  depends_on = [google_secret_manager_secret_version.secret-version-data]
}
```

## Argument Reference

The following arguments are supported:


* `name` -
  (Required)
  Name must be unique within a namespace, within a Cloud Run region.
  Is required when creating resources. Name is primarily intended
  for creation idempotence and configuration definition. Cannot be updated.
  More info: http://kubernetes.io/docs/user-guide/identifiers#names

* `location` -
  (Required)
  The location of the cloud run instance. eg us-central1



<a name="nested_traffic"></a>The `traffic` block supports:

* `revision_name` -
  (Optional)
  RevisionName of a specific revision to which to send this portion of traffic.

* `percent` -
  (Required)
  Percent specifies percent of the traffic to this Revision or Configuration.

* `latest_revision` -
  (Optional)
  LatestRevision may be optionally provided to indicate that the latest ready
  Revision of the Configuration should be used for this traffic target. When
  provided LatestRevision must be true if RevisionName is empty; it must be
  false when RevisionName is non-empty.

<a name="nested_template"></a>The `template` block supports:

* `metadata` -
  (Optional)
  Optional metadata for this Revision, including labels and annotations.
  Name will be generated by the Configuration. To set minimum instances
  for this revision, use the "autoscaling.knative.dev/minScale" annotation
  key. To set maximum instances for this revision, use the
  "autoscaling.knative.dev/maxScale" annotation key. To set Cloud SQL
  connections for the revision, use the "run.googleapis.com/cloudsql-instances"
  annotation key.
  Structure is [documented below](#nested_metadata).

* `spec` -
  (Required)
  RevisionSpec holds the desired state of the Revision (from the client).
  Structure is [documented below](#nested_spec).


<a name="nested_metadata"></a>The `metadata` block supports:

* `labels` -
  (Optional)
  Map of string keys and values that can be used to organize and categorize
  (scope and select) objects. May match selectors of replication controllers
  and routes.
  More info: http://kubernetes.io/docs/user-guide/labels

* `generation` -
  A sequence number representing a specific generation of the desired state.

* `resource_version` -
  An opaque value that represents the internal version of this object that
  can be used by clients to determine when objects have changed. May be used
  for optimistic concurrency, change detection, and the watch operation on a
  resource or set of resources. They may only be valid for a
  particular resource or set of resources.
  More info:
  https://git.k8s.io/community/contributors/devel/api-conventions.md#concurrency-control-and-consistency

* `self_link` -
  SelfLink is a URL representing this object.

* `uid` -
  UID is a unique id generated by the server on successful creation of a resource and is not
  allowed to change on PUT operations.
  More info: http://kubernetes.io/docs/user-guide/identifiers#uids

* `namespace` -
  (Optional)
  In Cloud Run the namespace must be equal to either the
  project ID or project number. It will default to the resource's project.

* `annotations` -
  (Optional)
  Annotations is a key value map stored with a resource that
  may be set by external tools to store and retrieve arbitrary metadata. More
  info: http://kubernetes.io/docs/user-guide/annotations
  **Note**: The Cloud Run API may add additional annotations that were not provided in your config.
  If terraform plan shows a diff where a server-side annotation is added, you can add it to your config
  or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.

* `name` -
  (Optional)
  Name must be unique within a namespace, within a Cloud Run region.
  Is required when creating resources. Name is primarily intended
  for creation idempotence and configuration definition. Cannot be updated.
  More info: http://kubernetes.io/docs/user-guide/identifiers#names

<a name="nested_spec"></a>The `spec` block supports:

* `containers` -
  (Required)
  Container defines the unit of execution for this Revision.
  In the context of a Revision, we disallow a number of the fields of
  this Container, including: name, ports, and volumeMounts.
  The runtime contract is documented here:
  https://github.com/knative/serving/blob/master/docs/runtime-contract.md
  Structure is [documented below](#nested_containers).

* `container_concurrency` -
  (Optional)
  ContainerConcurrency specifies the maximum allowed in-flight (concurrent)
  requests per container of the Revision. Values are:
  - `0` thread-safe, the system should manage the max concurrency. This is
      the default value.
  - `1` not-thread-safe. Single concurrency
  - `2-N` thread-safe, max concurrency of N

* `timeout_seconds` -
  (Optional)
  TimeoutSeconds holds the max duration the instance is allowed for responding to a request.

* `service_account_name` -
  (Optional)
  Email address of the IAM service account associated with the revision of the
  service. The service account represents the identity of the running revision,
  and determines what permissions the revision has. If not provided, the revision
  will use the project's default service account.

* `volumes` -
  (Optional)
  Volume represents a named volume in a container.
  Structure is [documented below](#nested_volumes).

* `serving_state` -
  ServingState holds a value describing the state the resources
  are in for this Revision.
  It is expected
  that the system will manipulate this based on routability and load.


<a name="nested_containers"></a>The `containers` block supports:

* `working_dir` -
  (Optional, Deprecated)
  Container's working directory.
  If not specified, the container runtime's default will be used, which
  might be configured in the container image.

* `args` -
  (Optional)
  Arguments to the entrypoint.
  The docker image's CMD is used if this is not provided.
  Variable references $(VAR_NAME) are expanded using the container's
  environment. If a variable cannot be resolved, the reference in the input
  string will be unchanged. The $(VAR_NAME) syntax can be escaped with a
  double $$, ie: $$(VAR_NAME). Escaped references will never be expanded,
  regardless of whether the variable exists or not.
  More info:
  https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell

* `env_from` -
  (Optional, Deprecated)
  List of sources to populate environment variables in the container.
  All invalid keys will be reported as an event when the container is starting.
  When a key exists in multiple sources, the value associated with the last source will
  take precedence. Values defined by an Env with a duplicate key will take
  precedence.
  Structure is [documented below](#nested_env_from).

* `image` -
  (Required)
  Docker image name. This is most often a reference to a container located
  in the container registry, such as gcr.io/cloudrun/hello
  More info: https://kubernetes.io/docs/concepts/containers/images

* `command` -
  (Optional)
  Entrypoint array. Not executed within a shell.
  The docker image's ENTRYPOINT is used if this is not provided.
  Variable references $(VAR_NAME) are expanded using the container's
  environment. If a variable cannot be resolved, the reference in the input
  string will be unchanged. The $(VAR_NAME) syntax can be escaped with a
  double $$, ie: $$(VAR_NAME). Escaped references will never be expanded,
  regardless of whether the variable exists or not.
  More info:
  https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell

* `env` -
  (Optional)
  List of environment variables to set in the container.
  Structure is [documented below](#nested_env).

* `ports` -
  (Optional)
  List of open ports in the container.
  More Info:
  https://cloud.google.com/run/docs/reference/rest/v1/RevisionSpec#ContainerPort
  Structure is [documented below](#nested_ports).

* `resources` -
  (Optional)
  Compute Resources required by this container. Used to set values such as max memory
  More info:
  https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits
  Structure is [documented below](#nested_resources).

* `volume_mounts` -
  (Optional)
  Volume to mount into the container's filesystem.
  Only supports SecretVolumeSources.
  Structure is [documented below](#nested_volume_mounts).


<a name="nested_env_from"></a>The `env_from` block supports:

* `prefix` -
  (Optional)
  An optional identifier to prepend to each key in the ConfigMap.

* `config_map_ref` -
  (Optional)
  The ConfigMap to select from.
  Structure is [documented below](#nested_config_map_ref).

* `secret_ref` -
  (Optional)
  The Secret to select from.
  Structure is [documented below](#nested_secret_ref).


<a name="nested_config_map_ref"></a>The `config_map_ref` block supports:

* `optional` -
  (Optional)
  Specify whether the ConfigMap must be defined

* `local_object_reference` -
  (Optional)
  The ConfigMap to select from.
  Structure is [documented below](#nested_local_object_reference).


<a name="nested_local_object_reference"></a>The `local_object_reference` block supports:

* `name` -
  (Required)
  Name of the referent.
  More info:
  https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

<a name="nested_secret_ref"></a>The `secret_ref` block supports:

* `local_object_reference` -
  (Optional)
  The Secret to select from.
  Structure is [documented below](#nested_local_object_reference).

* `optional` -
  (Optional)
  Specify whether the Secret must be defined


<a name="nested_local_object_reference"></a>The `local_object_reference` block supports:

* `name` -
  (Required)
  Name of the referent.
  More info:
  https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

<a name="nested_env"></a>The `env` block supports:

* `name` -
  (Optional)
  Name of the environment variable.

* `value` -
  (Optional)
  Variable references $(VAR_NAME) are expanded
  using the previous defined environment variables in the container and
  any route environment variables. If a variable cannot be resolved,
  the reference in the input string will be unchanged. The $(VAR_NAME)
  syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped
  references will never be expanded, regardless of whether the variable
  exists or not.
  Defaults to "".

* `value_from` -
  (Optional)
  Source for the environment variable's value. Only supports secret_key_ref.
  Structure is [documented below](#nested_value_from).


<a name="nested_value_from"></a>The `value_from` block supports:

* `secret_key_ref` -
  (Required)
  Selects a key (version) of a secret in Secret Manager.
  Structure is [documented below](#nested_secret_key_ref).


<a name="nested_secret_key_ref"></a>The `secret_key_ref` block supports:

* `key` -
  (Required)
  A Cloud Secret Manager secret version. Must be 'latest' for the latest
  version or an integer for a specific version.

* `name` -
  (Required)
  The name of the secret in Cloud Secret Manager. By default, the secret
  is assumed to be in the same project.
  If the secret is in another project, you must define an alias.
  You set the <alias> in this field, and create an annotation with the
  following structure
  "run.googleapis.com/secrets" = "<alias>:projects/<project-id|project-number>/secrets/<secret-name>".
  If multiple alias definitions are needed, they must be separated by
  commas in the annotation field.

<a name="nested_ports"></a>The `ports` block supports:

* `name` -
  (Optional)
  Name of the port.

* `protocol` -
  (Optional)
  Protocol used on port. Defaults to TCP.

* `container_port` -
  (Required)
  Port number.

<a name="nested_resources"></a>The `resources` block supports:

* `limits` -
  (Optional)
  Limits describes the maximum amount of compute resources allowed.
  The values of the map is string form of the 'quantity' k8s type:
  https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go

* `requests` -
  (Optional)
  Requests describes the minimum amount of compute resources required.
  If Requests is omitted for a container, it defaults to Limits if that is
  explicitly specified, otherwise to an implementation-defined value.
  The values of the map is string form of the 'quantity' k8s type:
  https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go

<a name="nested_volume_mounts"></a>The `volume_mounts` block supports:

* `mount_path` -
  (Required)
  Path within the container at which the volume should be mounted.  Must
  not contain ':'.

* `name` -
  (Required)
  This must match the Name of a Volume.

<a name="nested_volumes"></a>The `volumes` block supports:

* `name` -
  (Required)
  Volume's name.

* `secret` -
  (Required)
  The secret's value will be presented as the content of a file whose
  name is defined in the item path. If no items are defined, the name of
  the file is the secret_name.
  Structure is [documented below](#nested_secret).


<a name="nested_secret"></a>The `secret` block supports:

* `secret_name` -
  (Required)
  The name of the secret in Cloud Secret Manager. By default, the secret
  is assumed to be in the same project.
  If the secret is in another project, you must define an alias.
  An alias definition has the form:
  <alias>:projects/<project-id|project-number>/secrets/<secret-name>.
  If multiple alias definitions are needed, they must be separated by
  commas.
  The alias definitions must be set on the run.googleapis.com/secrets
  annotation.

* `items` -
  (Optional)
  If unspecified, the volume will expose a file whose name is the
  secret_name.
  If specified, the key will be used as the version to fetch from Cloud
  Secret Manager and the path will be the name of the file exposed in the
  volume. When items are defined, they must specify a key and a path.
  Structure is [documented below](#nested_items).


<a name="nested_items"></a>The `items` block supports:

* `key` -
  (Required)
  The Cloud Secret Manager secret version.
  Can be 'latest' for the latest value or an integer for a specific version.

* `path` -
  (Required)
  The relative path of the file to map the key to.
  May not be an absolute path.
  May not contain the path element '..'.
  May not start with the string '..'.

- - -


* `traffic` -
  (Optional)
  Traffic specifies how to distribute traffic over a collection of Knative Revisions
  and Configurations
  Structure is [documented below](#nested_traffic).

* `template` -
  (Optional)
  template holds the latest specification for the Revision to
  be stamped out. The template references the container image, and may also
  include labels and annotations that should be attached to the Revision.
  To correlate a Revision, and/or to force a Revision to be created when the
  spec doesn't otherwise change, a nonce label may be provided in the
  template metadata. For more details, see:
  https://github.com/knative/serving/blob/master/docs/client-conventions.md#associate-modifications-with-revisions
  Cloud Run does not currently support referencing a build that is
  responsible for materializing the container image from source.
  Structure is [documented below](#nested_template).

* `metadata` -
  (Optional)
  Metadata associated with this Service, including name, namespace, labels,
  and annotations.
  Structure is [documented below](#nested_metadata).

* `project` - (Optional) The ID of the project in which the resource belongs.
    If it is not provided, the provider project is used.

* `autogenerate_revision_name` - (Optional) If set to `true`, the revision name (template.metadata.name) will be omitted and
autogenerated by Cloud Run. This cannot be set to `true` while `template.metadata.name`
is also set.
(For legacy support, if `template.metadata.name` is unset in state while
this field is set to false, the revision name will still autogenerate.)


<a name="nested_metadata"></a>The `metadata` block supports:

* `labels` -
  (Optional)
  Map of string keys and values that can be used to organize and categorize
  (scope and select) objects. May match selectors of replication controllers
  and routes.
  More info: http://kubernetes.io/docs/user-guide/labels

* `generation` -
  A sequence number representing a specific generation of the desired state.

* `resource_version` -
  An opaque value that represents the internal version of this object that
  can be used by clients to determine when objects have changed. May be used
  for optimistic concurrency, change detection, and the watch operation on a
  resource or set of resources. They may only be valid for a
  particular resource or set of resources.
  More info:
  https://git.k8s.io/community/contributors/devel/api-conventions.md#concurrency-control-and-consistency

* `self_link` -
  SelfLink is a URL representing this object.

* `uid` -
  UID is a unique id generated by the server on successful creation of a resource and is not
  allowed to change on PUT operations.
  More info: http://kubernetes.io/docs/user-guide/identifiers#uids

* `namespace` -
  (Optional)
  In Cloud Run the namespace must be equal to either the
  project ID or project number.

* `annotations` -
  (Optional)
  Annotations is a key value map stored with a resource that
  may be set by external tools to store and retrieve arbitrary metadata. More
  info: http://kubernetes.io/docs/user-guide/annotations
  **Note**: The Cloud Run API may add additional annotations that were not provided in your config.
  If terraform plan shows a diff where a server-side annotation is added, you can add it to your config
  or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.
  Cloud Run (fully managed) uses the following annotation keys to configure features on a Service:
  - `run.googleapis.com/ingress` sets the [ingress settings](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--ingress)
    for the Service. For example, `"run.googleapis.com/ingress" = "all"`.

## Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

* `id` - an identifier for the resource with format `locations/{{location}}/namespaces/{{project}}/services/{{name}}`

* `status` -
  The current status of the Service.
  Structure is [documented below](#nested_status).


<a name="nested_status"></a>The `status` block contains:

* `conditions` -
  Array of observed Service Conditions, indicating the current ready state of the service.
  Structure is [documented below](#nested_conditions).

* `url` -
  From RouteStatus. URL holds the url that will distribute traffic over the provided traffic
  targets. It generally has the form
  https://{route-hash}-{project-hash}-{cluster-level-suffix}.a.run.app

* `observed_generation` -
  ObservedGeneration is the 'Generation' of the Route that was last processed by the
  controller.
  Clients polling for completed reconciliation should poll until observedGeneration =
  metadata.generation and the Ready condition's status is True or False.

* `latest_created_revision_name` -
  From ConfigurationStatus. LatestCreatedRevisionName is the last revision that was created
  from this Service's Configuration. It might not be ready yet, for that use
  LatestReadyRevisionName.

* `latest_ready_revision_name` -
  From ConfigurationStatus. LatestReadyRevisionName holds the name of the latest Revision
  stamped out from this Service's Configuration that has had its "Ready" condition become
  "True".


<a name="nested_conditions"></a>The `conditions` block contains:

* `message` -
  Human readable message indicating details about the current status.

* `status` -
  Status of the condition, one of True, False, Unknown.

* `reason` -
  One-word CamelCase reason for the condition's current status.

* `type` -
  Type of domain mapping condition.

## Timeouts

This resource provides the following
[Timeouts](/docs/configuration/resources.html#timeouts) configuration options:

- `create` - Default is 6 minutes.
- `update` - Default is 15 minutes.
- `delete` - Default is 4 minutes.

## Import


Service can be imported using any of these accepted formats:

```
$ terraform import google_cloud_run_service.default locations/{{location}}/namespaces/{{project}}/services/{{name}}
$ terraform import google_cloud_run_service.default {{location}}/{{project}}/{{name}}
$ terraform import google_cloud_run_service.default {{location}}/{{name}}
```

## User Project Overrides

This resource supports [User Project Overrides](https://www.terraform.io/docs/providers/google/guides/provider_reference.html#user_project_override).
<commit_msg>Change link to moved article about Knative Serving (#10623)<commit_after>---
# ----------------------------------------------------------------------------
#
#     ***     AUTO GENERATED CODE    ***    Type: MMv1     ***
#
# ----------------------------------------------------------------------------
#
#     This file is automatically generated by Magic Modules and manual
#     changes will be clobbered when the file is regenerated.
#
#     Please read more about how to change this file in
#     .github/CONTRIBUTING.md.
#
# ----------------------------------------------------------------------------
subcategory: "Cloud Run"
layout: "google"
page_title: "Google: google_cloud_run_service"
sidebar_current: "docs-google-cloud-run-service"
description: |-
  Service acts as a top-level container that manages a set of Routes and
  Configurations which implement a network service.
---

# google\_cloud\_run\_service

Service acts as a top-level container that manages a set of Routes and
Configurations which implement a network service. Service exists to provide a
singular abstraction which can be access controlled, reasoned about, and
which encapsulates software lifecycle decisions such as rollout policy and
team resource ownership. Service acts only as an orchestrator of the
underlying Routes and Configurations (much as a kubernetes Deployment
orchestrates ReplicaSets).

The Service's controller will track the statuses of its owned Configuration
and Route, reflecting their statuses and conditions as its own.

See also:
https://github.com/knative/specs/blob/main/specs/serving/overview.md


To get more information about Service, see:

* [API documentation](https://cloud.google.com/run/docs/reference/rest/v1/namespaces.services)
* How-to Guides
    * [Official Documentation](https://cloud.google.com/run/docs/)

~> **Warning:** `google_cloudrun_service` creates a Managed Google Cloud Run Service. If you need to create
a Cloud Run Service on Anthos(GKE/VMWare) then you will need to create it using the kubernetes alpha provider.
Have a look at the Cloud Run Anthos example below.

## Example Usage - Cloud Run Service Basic


```hcl
resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/hello"
      }
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
}
```
<div class = "oics-button" style="float: right; margin: 0 0 -15px">
  <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=cloud_run_service_sql&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
    <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
  </a>
</div>
## Example Usage - Cloud Run Service Sql


```hcl
resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/hello"
      }
    }

    metadata {
      annotations = {
        "autoscaling.knative.dev/maxScale"      = "1000"
        "run.googleapis.com/cloudsql-instances" = google_sql_database_instance.instance.connection_name
        "run.googleapis.com/client-name"        = "terraform"
      }
    }
  }
  autogenerate_revision_name = true
}

resource "google_sql_database_instance" "instance" {
  name             = "cloudrun-sql"
  region           = "us-east1"
  database_version = "MYSQL_5_7"
  settings {
    tier = "db-f1-micro"
  }

  deletion_protection  = "true"
}
```
## Example Usage - Cloud Run Service Noauth


```hcl
resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/hello"
      }
    }
  }
}

data "google_iam_policy" "noauth" {
  binding {
    role = "roles/run.invoker"
    members = [
      "allUsers",
    ]
  }
}

resource "google_cloud_run_service_iam_policy" "noauth" {
  location    = google_cloud_run_service.default.location
  project     = google_cloud_run_service.default.project
  service     = google_cloud_run_service.default.name

  policy_data = data.google_iam_policy.noauth.policy_data
}
```
## Example Usage - Cloud Run Anthos


```hcl
data "google_client_config" "provider" {}

data "google_container_cluster" "my_cluster" {
  name     = "cluster-1"
  location = "us-central1-c"
}

provider "kubernetes-alpha" {
  host  = "https://${data.google_container_cluster.my_cluster.endpoint}"
  token = data.google_client_config.provider.access_token
  cluster_ca_certificate = base64decode(
    data.google_container_cluster.my_cluster.master_auth.0.cluster_ca_certificate,
  )
}

resource "kubernetes_manifest" "test-configmap" {
  provider = kubernetes-alpha

  manifest = {
    "apiVersion" = "serving.knative.dev/v1"
    "kind"       = "Service"
    "metadata" = {
      "name"      = "helloworld-go"
      "namespace" = "default"
    }
    "spec" = {
      "template" = {
        "spec" = {
          "containers" = [
            {
              "image" = "us-docker.pkg.dev/cloudrun/container/hello"
            }
          ]
        }
      }
    }
  }
}
```
## Example Usage - Cloud Run Service Multiple Environment Variables


```hcl
resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/hello"
        env {
          name = "SOURCE"
          value = "remote"
        }
        env {
          name = "TARGET"
          value = "home"
        }
      }
    }
  }

  metadata {
    annotations = {
      generated-by = "magic-modules"
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
  autogenerate_revision_name = true

  lifecycle {
    ignore_changes = [
        metadata.0.annotations,
    ]
  }
}
```
## Example Usage - Cloud Run Service Traffic Split


```hcl
resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/hello"
      }
    }
    metadata {
      name = "cloudrun-srv-green"
    }
  }

  traffic {
    percent       = 25
    revision_name = "cloudrun-srv-green"
  }

  traffic {
    percent       = 75
    # This revision needs to already exist
    revision_name = "cloudrun-srv-blue"
  }
}
```
## Example Usage - Cloud Run Service Secret Environment Variables


```hcl
data "google_project" "project" {
}

resource "google_secret_manager_secret" "secret" {
  secret_id = "secret"
  replication {
    automatic = true
  }
}

resource "google_secret_manager_secret_version" "secret-version-data" {
  secret = google_secret_manager_secret.secret.name
  secret_data = "secret-data"
}

resource "google_secret_manager_secret_iam_member" "secret-access" {
  secret_id = google_secret_manager_secret.secret.id
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${data.google_project.project.number}-<EMAIL>"
  depends_on = [google_secret_manager_secret.secret]
}

resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "gcr.io/cloudrun/hello"
        env {
          name = "SECRET_ENV_VAR"
	  value_from {
            secret_key_ref {
              name = google_secret_manager_secret.secret.secret_id
              key = "1"
            }
          }
        }
      }
    }
  }

  metadata {
    annotations = {
      generated-by = "magic-modules"
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
  autogenerate_revision_name = true

  lifecycle {
    ignore_changes = [
        metadata.0.annotations,
    ]
  }

  depends_on = [google_secret_manager_secret_version.secret-version-data]
}
```
## Example Usage - Cloud Run Service Secret Volumes


```hcl
data "google_project" "project" {
}

resource "google_secret_manager_secret" "secret" {
  secret_id = "secret"
  replication {
    automatic = true
  }
}

resource "google_secret_manager_secret_version" "secret-version-data" {
  secret = google_secret_manager_secret.secret.name
  secret_data = "secret-data"
}

resource "google_secret_manager_secret_iam_member" "secret-access" {
  secret_id = google_secret_manager_secret.secret.id
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${data.google_project.project.number}-<EMAIL>"
  depends_on = [google_secret_manager_secret.secret]
}

resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "gcr.io/cloudrun/hello"
	volume_mounts {
	  name = "a-volume"
	  mount_path = "/secrets"
	}
      }
      volumes {
        name = "a-volume"
	secret {
	  secret_name = google_secret_manager_secret.secret.secret_id
	  items {
            key = "1"
	    path = "my-secret"
	  }
	}
      }
    }
  }

  metadata {
    annotations = {
      generated-by = "magic-modules"
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
  autogenerate_revision_name = true

  lifecycle {
    ignore_changes = [
        metadata.0.annotations,
    ]
  }

  depends_on = [google_secret_manager_secret_version.secret-version-data]
}
```

## Argument Reference

The following arguments are supported:


* `name` -
  (Required)
  Name must be unique within a namespace, within a Cloud Run region.
  Is required when creating resources. Name is primarily intended
  for creation idempotence and configuration definition. Cannot be updated.
  More info: http://kubernetes.io/docs/user-guide/identifiers#names

* `location` -
  (Required)
  The location of the cloud run instance. eg us-central1



<a name="nested_traffic"></a>The `traffic` block supports:

* `revision_name` -
  (Optional)
  RevisionName of a specific revision to which to send this portion of traffic.

* `percent` -
  (Required)
  Percent specifies percent of the traffic to this Revision or Configuration.

* `latest_revision` -
  (Optional)
  LatestRevision may be optionally provided to indicate that the latest ready
  Revision of the Configuration should be used for this traffic target. When
  provided LatestRevision must be true if RevisionName is empty; it must be
  false when RevisionName is non-empty.

<a name="nested_template"></a>The `template` block supports:

* `metadata` -
  (Optional)
  Optional metadata for this Revision, including labels and annotations.
  Name will be generated by the Configuration. To set minimum instances
  for this revision, use the "autoscaling.knative.dev/minScale" annotation
  key. To set maximum instances for this revision, use the
  "autoscaling.knative.dev/maxScale" annotation key. To set Cloud SQL
  connections for the revision, use the "run.googleapis.com/cloudsql-instances"
  annotation key.
  Structure is [documented below](#nested_metadata).

* `spec` -
  (Required)
  RevisionSpec holds the desired state of the Revision (from the client).
  Structure is [documented below](#nested_spec).


<a name="nested_metadata"></a>The `metadata` block supports:

* `labels` -
  (Optional)
  Map of string keys and values that can be used to organize and categorize
  (scope and select) objects. May match selectors of replication controllers
  and routes.
  More info: http://kubernetes.io/docs/user-guide/labels

* `generation` -
  A sequence number representing a specific generation of the desired state.

* `resource_version` -
  An opaque value that represents the internal version of this object that
  can be used by clients to determine when objects have changed. May be used
  for optimistic concurrency, change detection, and the watch operation on a
  resource or set of resources. They may only be valid for a
  particular resource or set of resources.
  More info:
  https://git.k8s.io/community/contributors/devel/api-conventions.md#concurrency-control-and-consistency

* `self_link` -
  SelfLink is a URL representing this object.

* `uid` -
  UID is a unique id generated by the server on successful creation of a resource and is not
  allowed to change on PUT operations.
  More info: http://kubernetes.io/docs/user-guide/identifiers#uids

* `namespace` -
  (Optional)
  In Cloud Run the namespace must be equal to either the
  project ID or project number. It will default to the resource's project.

* `annotations` -
  (Optional)
  Annotations is a key value map stored with a resource that
  may be set by external tools to store and retrieve arbitrary metadata. More
  info: http://kubernetes.io/docs/user-guide/annotations
  **Note**: The Cloud Run API may add additional annotations that were not provided in your config.
  If terraform plan shows a diff where a server-side annotation is added, you can add it to your config
  or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.

* `name` -
  (Optional)
  Name must be unique within a namespace, within a Cloud Run region.
  Is required when creating resources. Name is primarily intended
  for creation idempotence and configuration definition. Cannot be updated.
  More info: http://kubernetes.io/docs/user-guide/identifiers#names

<a name="nested_spec"></a>The `spec` block supports:

* `containers` -
  (Required)
  Container defines the unit of execution for this Revision.
  In the context of a Revision, we disallow a number of the fields of
  this Container, including: name, ports, and volumeMounts.
  The runtime contract is documented here:
  https://github.com/knative/serving/blob/master/docs/runtime-contract.md
  Structure is [documented below](#nested_containers).

* `container_concurrency` -
  (Optional)
  ContainerConcurrency specifies the maximum allowed in-flight (concurrent)
  requests per container of the Revision. Values are:
  - `0` thread-safe, the system should manage the max concurrency. This is
      the default value.
  - `1` not-thread-safe. Single concurrency
  - `2-N` thread-safe, max concurrency of N

* `timeout_seconds` -
  (Optional)
  TimeoutSeconds holds the max duration the instance is allowed for responding to a request.

* `service_account_name` -
  (Optional)
  Email address of the IAM service account associated with the revision of the
  service. The service account represents the identity of the running revision,
  and determines what permissions the revision has. If not provided, the revision
  will use the project's default service account.

* `volumes` -
  (Optional)
  Volume represents a named volume in a container.
  Structure is [documented below](#nested_volumes).

* `serving_state` -
  ServingState holds a value describing the state the resources
  are in for this Revision.
  It is expected
  that the system will manipulate this based on routability and load.


<a name="nested_containers"></a>The `containers` block supports:

* `working_dir` -
  (Optional, Deprecated)
  Container's working directory.
  If not specified, the container runtime's default will be used, which
  might be configured in the container image.

* `args` -
  (Optional)
  Arguments to the entrypoint.
  The docker image's CMD is used if this is not provided.
  Variable references $(VAR_NAME) are expanded using the container's
  environment. If a variable cannot be resolved, the reference in the input
  string will be unchanged. The $(VAR_NAME) syntax can be escaped with a
  double $$, ie: $$(VAR_NAME). Escaped references will never be expanded,
  regardless of whether the variable exists or not.
  More info:
  https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell

* `env_from` -
  (Optional, Deprecated)
  List of sources to populate environment variables in the container.
  All invalid keys will be reported as an event when the container is starting.
  When a key exists in multiple sources, the value associated with the last source will
  take precedence. Values defined by an Env with a duplicate key will take
  precedence.
  Structure is [documented below](#nested_env_from).

* `image` -
  (Required)
  Docker image name. This is most often a reference to a container located
  in the container registry, such as gcr.io/cloudrun/hello
  More info: https://kubernetes.io/docs/concepts/containers/images

* `command` -
  (Optional)
  Entrypoint array. Not executed within a shell.
  The docker image's ENTRYPOINT is used if this is not provided.
  Variable references $(VAR_NAME) are expanded using the container's
  environment. If a variable cannot be resolved, the reference in the input
  string will be unchanged. The $(VAR_NAME) syntax can be escaped with a
  double $$, ie: $$(VAR_NAME). Escaped references will never be expanded,
  regardless of whether the variable exists or not.
  More info:
  https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell

* `env` -
  (Optional)
  List of environment variables to set in the container.
  Structure is [documented below](#nested_env).

* `ports` -
  (Optional)
  List of open ports in the container.
  More Info:
  https://cloud.google.com/run/docs/reference/rest/v1/RevisionSpec#ContainerPort
  Structure is [documented below](#nested_ports).

* `resources` -
  (Optional)
  Compute Resources required by this container. Used to set values such as max memory
  More info:
  https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits
  Structure is [documented below](#nested_resources).

* `volume_mounts` -
  (Optional)
  Volume to mount into the container's filesystem.
  Only supports SecretVolumeSources.
  Structure is [documented below](#nested_volume_mounts).


<a name="nested_env_from"></a>The `env_from` block supports:

* `prefix` -
  (Optional)
  An optional identifier to prepend to each key in the ConfigMap.

* `config_map_ref` -
  (Optional)
  The ConfigMap to select from.
  Structure is [documented below](#nested_config_map_ref).

* `secret_ref` -
  (Optional)
  The Secret to select from.
  Structure is [documented below](#nested_secret_ref).


<a name="nested_config_map_ref"></a>The `config_map_ref` block supports:

* `optional` -
  (Optional)
  Specify whether the ConfigMap must be defined

* `local_object_reference` -
  (Optional)
  The ConfigMap to select from.
  Structure is [documented below](#nested_local_object_reference).


<a name="nested_local_object_reference"></a>The `local_object_reference` block supports:

* `name` -
  (Required)
  Name of the referent.
  More info:
  https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

<a name="nested_secret_ref"></a>The `secret_ref` block supports:

* `local_object_reference` -
  (Optional)
  The Secret to select from.
  Structure is [documented below](#nested_local_object_reference).

* `optional` -
  (Optional)
  Specify whether the Secret must be defined


<a name="nested_local_object_reference"></a>The `local_object_reference` block supports:

* `name` -
  (Required)
  Name of the referent.
  More info:
  https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

<a name="nested_env"></a>The `env` block supports:

* `name` -
  (Optional)
  Name of the environment variable.

* `value` -
  (Optional)
  Variable references $(VAR_NAME) are expanded
  using the previous defined environment variables in the container and
  any route environment variables. If a variable cannot be resolved,
  the reference in the input string will be unchanged. The $(VAR_NAME)
  syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped
  references will never be expanded, regardless of whether the variable
  exists or not.
  Defaults to "".

* `value_from` -
  (Optional)
  Source for the environment variable's value. Only supports secret_key_ref.
  Structure is [documented below](#nested_value_from).


<a name="nested_value_from"></a>The `value_from` block supports:

* `secret_key_ref` -
  (Required)
  Selects a key (version) of a secret in Secret Manager.
  Structure is [documented below](#nested_secret_key_ref).


<a name="nested_secret_key_ref"></a>The `secret_key_ref` block supports:

* `key` -
  (Required)
  A Cloud Secret Manager secret version. Must be 'latest' for the latest
  version or an integer for a specific version.

* `name` -
  (Required)
  The name of the secret in Cloud Secret Manager. By default, the secret
  is assumed to be in the same project.
  If the secret is in another project, you must define an alias.
  You set the <alias> in this field, and create an annotation with the
  following structure
  "run.googleapis.com/secrets" = "<alias>:projects/<project-id|project-number>/secrets/<secret-name>".
  If multiple alias definitions are needed, they must be separated by
  commas in the annotation field.

<a name="nested_ports"></a>The `ports` block supports:

* `name` -
  (Optional)
  Name of the port.

* `protocol` -
  (Optional)
  Protocol used on port. Defaults to TCP.

* `container_port` -
  (Required)
  Port number.

<a name="nested_resources"></a>The `resources` block supports:

* `limits` -
  (Optional)
  Limits describes the maximum amount of compute resources allowed.
  The values of the map is string form of the 'quantity' k8s type:
  https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go

* `requests` -
  (Optional)
  Requests describes the minimum amount of compute resources required.
  If Requests is omitted for a container, it defaults to Limits if that is
  explicitly specified, otherwise to an implementation-defined value.
  The values of the map is string form of the 'quantity' k8s type:
  https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go

<a name="nested_volume_mounts"></a>The `volume_mounts` block supports:

* `mount_path` -
  (Required)
  Path within the container at which the volume should be mounted.  Must
  not contain ':'.

* `name` -
  (Required)
  This must match the Name of a Volume.

<a name="nested_volumes"></a>The `volumes` block supports:

* `name` -
  (Required)
  Volume's name.

* `secret` -
  (Required)
  The secret's value will be presented as the content of a file whose
  name is defined in the item path. If no items are defined, the name of
  the file is the secret_name.
  Structure is [documented below](#nested_secret).


<a name="nested_secret"></a>The `secret` block supports:

* `secret_name` -
  (Required)
  The name of the secret in Cloud Secret Manager. By default, the secret
  is assumed to be in the same project.
  If the secret is in another project, you must define an alias.
  An alias definition has the form:
  <alias>:projects/<project-id|project-number>/secrets/<secret-name>.
  If multiple alias definitions are needed, they must be separated by
  commas.
  The alias definitions must be set on the run.googleapis.com/secrets
  annotation.

* `items` -
  (Optional)
  If unspecified, the volume will expose a file whose name is the
  secret_name.
  If specified, the key will be used as the version to fetch from Cloud
  Secret Manager and the path will be the name of the file exposed in the
  volume. When items are defined, they must specify a key and a path.
  Structure is [documented below](#nested_items).


<a name="nested_items"></a>The `items` block supports:

* `key` -
  (Required)
  The Cloud Secret Manager secret version.
  Can be 'latest' for the latest value or an integer for a specific version.

* `path` -
  (Required)
  The relative path of the file to map the key to.
  May not be an absolute path.
  May not contain the path element '..'.
  May not start with the string '..'.

- - -


* `traffic` -
  (Optional)
  Traffic specifies how to distribute traffic over a collection of Knative Revisions
  and Configurations
  Structure is [documented below](#nested_traffic).

* `template` -
  (Optional)
  template holds the latest specification for the Revision to
  be stamped out. The template references the container image, and may also
  include labels and annotations that should be attached to the Revision.
  To correlate a Revision, and/or to force a Revision to be created when the
  spec doesn't otherwise change, a nonce label may be provided in the
  template metadata. For more details, see:
  https://github.com/knative/serving/blob/master/docs/client-conventions.md#associate-modifications-with-revisions
  Cloud Run does not currently support referencing a build that is
  responsible for materializing the container image from source.
  Structure is [documented below](#nested_template).

* `metadata` -
  (Optional)
  Metadata associated with this Service, including name, namespace, labels,
  and annotations.
  Structure is [documented below](#nested_metadata).

* `project` - (Optional) The ID of the project in which the resource belongs.
    If it is not provided, the provider project is used.

* `autogenerate_revision_name` - (Optional) If set to `true`, the revision name (template.metadata.name) will be omitted and
autogenerated by Cloud Run. This cannot be set to `true` while `template.metadata.name`
is also set.
(For legacy support, if `template.metadata.name` is unset in state while
this field is set to false, the revision name will still autogenerate.)


<a name="nested_metadata"></a>The `metadata` block supports:

* `labels` -
  (Optional)
  Map of string keys and values that can be used to organize and categorize
  (scope and select) objects. May match selectors of replication controllers
  and routes.
  More info: http://kubernetes.io/docs/user-guide/labels

* `generation` -
  A sequence number representing a specific generation of the desired state.

* `resource_version` -
  An opaque value that represents the internal version of this object that
  can be used by clients to determine when objects have changed. May be used
  for optimistic concurrency, change detection, and the watch operation on a
  resource or set of resources. They may only be valid for a
  particular resource or set of resources.
  More info:
  https://git.k8s.io/community/contributors/devel/api-conventions.md#concurrency-control-and-consistency

* `self_link` -
  SelfLink is a URL representing this object.

* `uid` -
  UID is a unique id generated by the server on successful creation of a resource and is not
  allowed to change on PUT operations.
  More info: http://kubernetes.io/docs/user-guide/identifiers#uids

* `namespace` -
  (Optional)
  In Cloud Run the namespace must be equal to either the
  project ID or project number.

* `annotations` -
  (Optional)
  Annotations is a key value map stored with a resource that
  may be set by external tools to store and retrieve arbitrary metadata. More
  info: http://kubernetes.io/docs/user-guide/annotations
  **Note**: The Cloud Run API may add additional annotations that were not provided in your config.
  If terraform plan shows a diff where a server-side annotation is added, you can add it to your config
  or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.
  Cloud Run (fully managed) uses the following annotation keys to configure features on a Service:
  - `run.googleapis.com/ingress` sets the [ingress settings](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--ingress)
    for the Service. For example, `"run.googleapis.com/ingress" = "all"`.

## Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

* `id` - an identifier for the resource with format `locations/{{location}}/namespaces/{{project}}/services/{{name}}`

* `status` -
  The current status of the Service.
  Structure is [documented below](#nested_status).


<a name="nested_status"></a>The `status` block contains:

* `conditions` -
  Array of observed Service Conditions, indicating the current ready state of the service.
  Structure is [documented below](#nested_conditions).

* `url` -
  From RouteStatus. URL holds the url that will distribute traffic over the provided traffic
  targets. It generally has the form
  https://{route-hash}-{project-hash}-{cluster-level-suffix}.a.run.app

* `observed_generation` -
  ObservedGeneration is the 'Generation' of the Route that was last processed by the
  controller.
  Clients polling for completed reconciliation should poll until observedGeneration =
  metadata.generation and the Ready condition's status is True or False.

* `latest_created_revision_name` -
  From ConfigurationStatus. LatestCreatedRevisionName is the last revision that was created
  from this Service's Configuration. It might not be ready yet, for that use
  LatestReadyRevisionName.

* `latest_ready_revision_name` -
  From ConfigurationStatus. LatestReadyRevisionName holds the name of the latest Revision
  stamped out from this Service's Configuration that has had its "Ready" condition become
  "True".


<a name="nested_conditions"></a>The `conditions` block contains:

* `message` -
  Human readable message indicating details about the current status.

* `status` -
  Status of the condition, one of True, False, Unknown.

* `reason` -
  One-word CamelCase reason for the condition's current status.

* `type` -
  Type of domain mapping condition.

## Timeouts

This resource provides the following
[Timeouts](/docs/configuration/resources.html#timeouts) configuration options:

- `create` - Default is 6 minutes.
- `update` - Default is 15 minutes.
- `delete` - Default is 4 minutes.

## Import


Service can be imported using any of these accepted formats:

```
$ terraform import google_cloud_run_service.default locations/{{location}}/namespaces/{{project}}/services/{{name}}
$ terraform import google_cloud_run_service.default {{location}}/{{project}}/{{name}}
$ terraform import google_cloud_run_service.default {{location}}/{{name}}
```

## User Project Overrides

This resource supports [User Project Overrides](https://www.terraform.io/docs/providers/google/guides/provider_reference.html#user_project_override).

{'fraction_non_alphanumeric': 0.09756336876533116, 'fraction_numerical': 0.0027636958299264106, 'mean_word_length': 3.541477905681396, 'pattern_counts': {'":': 0, '<': 119, '<?xml version=': 0, '>': 121, 'https://': 42, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2971736', 'n_tokens_mistral': 18296, 'n_tokens_neox': 17532, 'n_words': 6106}