Cloud Run

Use the Cloud Run integration to let a workbench call one of your Google Cloud Run services as an action. You describe what the service does and the input it accepts, and the workbench agent decides when to call it, builds the input, and reads the service's response. Typical uses include running a runbook step, querying an internal system, or triggering automation you already host on Cloud Run.

The Cloud Run tool reuses a Plural cloud connection for GCP credentials. This guide uses the Plural Console UI. For the complete list of integrations and general tool behavior, see Workbench tools.

Prerequisites

Before you begin, make sure you have:

• A deployed Cloud Run service that accepts an HTTP POST with a JSON body.
• A GCP cloud connection whose service account can invoke the service. See Grant invoke access.
• Permission in Plural Console to create a configured tool and edit the target workbench.
• An existing workbench, or permission to create one. See Setting up a workbench.

Grant invoke access

The Cloud Run tool authenticates as the service account in the GCP cloud connection, using a Google-signed ID token. Grant that service account:

• Cloud Run Invoker (roles/run.invoker) on the service, which allows run.routes.invoke. Viewer roles commonly used for cloud queries do not include it.
• run.services.get, included in roles/run.viewer and roles/viewer, if you identify the service by resource name rather than URL.

For example, with the gcloud CLI:

gcloud run services add-iam-policy-binding restart-service \
  --region=us-central1 \
  --member="serviceAccount:plural-cloud-query@my-project.iam.gserviceaccount.com" \
  --role="roles/run.invoker"