terraformdevopsgoogle-cloud-runterraform-provider-gcpterraform-cloud

cloud run deployment pattern when new images are pushed, if services are created via terraform, is it avoidable?

I have a set of cloud run services created/maintained via terraform cloud.

When I create a new version, a github actions workflow pushes a new image to gcr.io.

Now in a normal scenario, I'd call:

gcloud run deploy auth-service --image gcr.io/riu-production/auth-service:latest

And a new version would be up. If I do this and the resource is managed by terraform, on the next run, terraform apply will fail saying it can't create that cloud run service due to a service with that name already existing. So it drifts apart in state and terraform no longer recognizes it.

A simple solution is to connect the pipeline to terraform cloud and run terraform apply -auto-approve for deployment purposes. That should work.

The problem with that is I really realy don't want to apply terraform commands in a pipeline, for now.

And the biggest one is I really would like to keep terraform out of the deployment process altogether.

Is there any way to force cloud run to take that new image for a service without messing up the terraform infrastructure?

Cloud run configs:

resource "google_cloud_run_service" "auth-service" {
  name     = "auth-service"
  location = var.gcp_region
  project  = var.gcp_project

  template {
    spec {
      service_account_name = module.cloudrun-sa.email
      containers {
        image = "gcr.io/${var.gcp_project}/auth-service:latest"
      }
    }
  }
  traffic {
    percent         = 100
    latest_revision = true
  }


}
Solution

  • In theory yes it should be possible ...
    But I would recommend against that, you should be doing terraform apply on every deployment to guarantee the infrastructure is as expected.

    Here are some things you can try: