Google Cloud Run

marmotdata/cloudrun

Discover services and jobs from Google Cloud Run

Compute Assets Lineage Run History Experimental

The Cloud Run plugin discovers services and jobs from a Google Cloud project using the Cloud Run Admin API v2. It records the deployed image, scaling, networking and volume configuration of each workload, the execution count of each job, and the recent executions of each job as run history.

Every region is scanned in one call unless locations is set. Regions Cloud Run reports as unreachable are logged and skipped rather than failing the run.

Connection Examples

Lineage

Cloud Run only reveals a data dependency through a volume mount. A Cloud Storage volume becomes a FEEDS edge from the bucket to the service or job that mounts it, matching the identity the gcs plugin gives that bucket.

Cloud SQL volumes are recorded in the cloud_sql_instances metadata field but produce no edge: the API does not say which engine an instance runs, so there is no provider to address it by.

Required Permissions

The service account needs the following IAM role:

Cloud Run Viewer (roles/run.viewer) - For listing services, jobs and executions

Or use a custom role with these permissions:

run.services.list
run.jobs.list
run.executions.list

Keyless authentication

On Marmot Cloud or Marmot Enterprise the pipeline can present its own identity instead of a service account key. Set workload_identity_provider to a Workload Identity Federation provider that trusts your Marmot instance as an OIDC issuer, and grant the pipeline's subject, pipeline:<name> as reported by the pipeline API, the role above directly (principal://iam.googleapis.com/<pool>/subject/pipeline:<name>), or grant it roles/iam.workloadIdentityUser on a service account named in service_account. No key exists anywhere; Marmot mints a short-lived token for each run.

In the UI

Point-and-click, no config file needed.

1 Open Runs Create pipeline
2 Pick Google Cloud Run from the plugin list.
3 Fill in the wizard, set a schedule, save.

Read the UI guide

With the CLI

Save a YAML config, then run marmot ingest.

ingest.yaml yaml

name: my-cloudrun-pipeline
runs:
  - cloudrun:
      project_id: "<project_id>"

$ marmot ingest -c ingest.yaml

Read the CLI guide

Not using plugins? Other ways to populate Marmot

Terraform Declare assets as infrastructure-as-code. Pulumi Native TypeScript, Python, or Go resources. Kubernetes Operator Sync assets from Kubernetes custom resources.

Configuration

15 top-level fields. * marks required fields.

tags multiselect

Tags to apply to discovered assets

external_links object[]

External links to show on all assets

name string

Display name for the link

icon string

Icon identifier for the link

url string

URL to the external resource

filter object

Filter discovered assets by name (regex)

include multiselect

Include patterns for resource names (regex)

exclude multiselect

Exclude patterns for resource names (regex)

audience string

Audience of the Marmot identity token. Derived from the credentials' federation settings; set it only when the cloud side expects another

project_id string

Google Cloud project ID

locations multiselect

Regions to scan. Every region is scanned when this is empty

credentials_file string

Path to service account JSON file

credentials_json password

Service account JSON content

workload_identity_provider string

Workload Identity Federation provider to exchange the Marmot identity token at, projects/<number>/locations/global/workloadIdentityPools/<pool>/providers/<provider>. Setting it federates: no key is needed; bind the pipeline's subject on the Google Cloud side

service_account string

Service account to impersonate after the exchange; empty acts as the federated principal directly

endpoint string

Custom endpoint URL, for testing against a local server

disable_auth bool

Disable authentication, for local testing

include_jobs bool

Whether to discover jobs

default: true

include_executions bool

Whether to read recent job executions as run history

default: true

max_executions_per_job int

How many recent executions to read per job

default: 10

Assets emitted

Metadata this plugin attaches to each discovered asset.

Service

ServiceFields

32 fields

The metadata the Cloud Run plugin emits for a Service asset.

uid string

Server-assigned unique identifier for the service

generation int

Number of times the service configuration has changed

location string

Region the service runs in

project_id string

Google Cloud project the service belongs to

uri string

HTTPS endpoint the service is served on

ingress string

Which traffic is allowed to reach the service

launch_stage string

Google Cloud launch stage of the features the service uses

creator string

Principal that created the service

last_modifier string

Principal that last modified the service

create_time string

Creation timestamp

update_time string

Last update timestamp

latest_ready_revision string

Id of the most recent revision that became ready

latest_created_revision string

Id of the most recently created revision

traffic string

Traffic split across revisions, for example latest=100

ready string

State of the service terminal condition

reconciling bool

Whether the service is still converging on its desired state

execution_environment string

Sandbox generation the containers run in

service_account string

Service account the containers run as

timeout string

Maximum duration of a single request

max_instance_request_concurrency int

Concurrent requests one instance accepts

min_instance_count int

Minimum number of instances kept running

max_instance_count int

Maximum number of instances the service scales to

container_image string

Image of the first container

container_images string[]

Images of every container in the revision

container_ports int[]

Ports the containers listen on

env_var_names string[]

Names of the container environment variables. Values are never recorded

vpc_connector string

Serverless VPC Access connector the service uses

vpc_egress string

Which outbound traffic is routed through the VPC

gcs_volume_buckets string[]

Cloud Storage buckets mounted as volumes

cloud_sql_instances string[]

Cloud SQL instances mounted as volumes, as project:region:instance

secret_volumes string[]

Names of the Secret Manager secrets mounted as volumes. Values are never recorded

nfs_volumes string[]

NFS mounts, as server:path

Job

JobFields

28 fields

The metadata the Cloud Run plugin emits for a Job asset.

uid string

Server-assigned unique identifier for the job

generation int

Number of times the job configuration has changed

location string

Region the job runs in

project_id string

Google Cloud project the job belongs to

creator string

Principal that created the job

last_modifier string

Principal that last modified the job

create_time string

Creation timestamp

update_time string

Last update timestamp

launch_stage string

Google Cloud launch stage of the features the job uses

execution_count int

Number of executions created for the job

latest_created_execution string

Id of the most recently created execution

reconciling bool

Whether the job is still converging on its desired state

task_count int

Number of tasks one execution runs

parallelism int

How many tasks may run at the same time

max_retries int

Retries allowed per failed task

execution_environment string

Sandbox generation the tasks run in

service_account string

Service account the tasks run as

timeout string

Maximum duration of a single task

container_image string

Image of the first container

container_images string[]

Images of every container in the task

container_ports int[]

Ports the containers listen on

env_var_names string[]

Names of the container environment variables. Values are never recorded

vpc_connector string

Serverless VPC Access connector the job uses

vpc_egress string

Which outbound traffic is routed through the VPC

gcs_volume_buckets string[]

Cloud Storage buckets mounted as volumes

cloud_sql_instances string[]

Cloud SQL instances mounted as volumes, as project:region:instance

secret_volumes string[]

Names of the Secret Manager secrets mounted as volumes. Values are never recorded

nfs_volumes string[]

NFS mounts, as server:path

Run Facet

RunFacetFields

6 fields

The facets attached to each job run event.

task_count int

Tasks the execution was asked to run

succeeded_count int

Tasks that succeeded

failed_count int

Tasks that failed

cancelled_count int

Tasks that were cancelled

retried_count int

Tasks that were retried

log_uri string

Cloud Logging link for the execution