gcloud-help/gcloud/beta/run/worker-pools/deploy

NAME
    gcloud beta run worker-pools deploy - create or update a Cloud Run
        worker-pool

SYNOPSIS
    gcloud beta run worker-pools deploy [[WORKER_POOL] --region=REGION]
        [--async] [--breakglass=JUSTIFICATION] [--container=CONTAINER]
        [--description=DESCRIPTION] [--gpu-type=GPU_TYPE]
        [--[no-]gpu-zonal-redundancy] [--instances=INSTANCES] [--no-promote]
        [--remove-containers=[CONTAINER,...]]
        [--revision-suffix=REVISION_SUFFIX] [--service-account=SERVICE_ACCOUNT]
        [--vpc-egress=VPC_EGRESS]
        [--add-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
          | --clear-cloudsql-instances
          | --remove-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
          | --set-cloudsql-instances=[CLOUDSQL-INSTANCES,...]]
        [--add-volume=[KEY=VALUE,...]
          --clear-volumes --remove-volume=[VOLUME,...]]
        [--add-volume-mount=[volume=NAME,mount-path=MOUNT_PATH,...]
          --args=[ARG,...] --clear-volume-mounts --command=[COMMAND,...]
          --cpu=CPU --depends-on=[CONTAINER,...] --gpu=GPU --memory=MEMORY
          --remove-volume-mount=[MOUNT_PATH,...]
          --workdir=WORKDIR --clear-env-vars | --env-vars-file=FILE_PATH
          | --set-env-vars=[KEY=VALUE,...] | --remove-env-vars=[KEY,...]
          --update-env-vars=[KEY=VALUE,...] --clear-secrets
          | --set-secrets=[KEY=VALUE,...] | --remove-secrets=[KEY,...]
          --update-secrets=[KEY=VALUE,...] --image=IMAGE | --source=SOURCE]
        [--binary-authorization=POLICY | --clear-binary-authorization]
        [--clear-encryption-key-shutdown-hours
          | --encryption-key-shutdown-hours=ENCRYPTION_KEY_SHUTDOWN_HOURS]
        [--clear-key | --key=KEY]
        [--clear-labels | --remove-labels=[KEY,...] --labels=[KEY=VALUE,...]
          | --update-labels=[KEY=VALUE,...]]
        [--clear-network
          | --network=NETWORK --subnet=SUBNET --clear-network-tags
          | --network-tags=[TAG,...]]
        [--clear-post-key-revocation-action-type
          | --post-key-revocation-action-type=POST_KEY_REVOCATION_ACTION_TYPE]
        [GCLOUD_WIDE_FLAG ...]

DESCRIPTION
    (BETA) Creates or updates a Cloud Run worker-pool.

EXAMPLES
    To deploy a container to the worker-pool my-backend on Cloud Run:

        $ gcloud beta run worker-pools deploy my-backend \
          --image=us-docker.pkg.dev/project/image

    You may also omit the worker-pool name. Then a prompt will be displayed
    with a suggested default value:

        $ gcloud beta run worker-pools deploy \
          --image=us-docker.pkg.dev/project/image

POSITIONAL ARGUMENTS
     WorkerPool resource - WorkerPool to deploy to. The arguments in this group
     can be used to specify the attributes of this resource. (NOTE) Some
     attributes are not given arguments in this group but can be set in other
     ways.

     To set the project attribute:
      ◆ provide the argument WORKER_POOL on the command line with a fully
        specified name;
      ◆ specify the workerpool name from an interactive prompt with a fully
        specified name;
      ◆ provide the argument --project on the command line;
      ◆ set the property core/project.

     [WORKER_POOL]
        ID of the WorkerPool or fully qualified identifier for the WorkerPool.

        To set the worker-pool attribute:
        ◆ provide the argument WORKER_POOL on the command line;
        ◆ specify the workerpool name from an interactive prompt.

     --region=REGION
        The Cloud region for the WorkerPool. Overrides the default run/region
        property value for this command invocation.

        To set the region attribute:
        ◆ provide the argument WORKER_POOL on the command line with a fully
          specified name;
        ◆ specify the workerpool name from an interactive prompt with a fully
          specified name;
        ◆ provide the argument --region on the command line;
        ◆ set the property run/region;
        ◆ specify the region from an interactive prompt.

FLAGS
     --async
        Return immediately, without waiting for the operation in progress to
        complete.

     --breakglass=JUSTIFICATION
        Justification to bypass Binary Authorization policy constraints and
        allow the operation. See
        https://cloud.google.com/binary-authorization/docs/using-breakglass for
        more information. Next update or deploy command will automatically
        clear existing breakglass justification.

     --container=CONTAINER
        Specifies a container by name. Flags following --container will apply
        to the specified container.

        Flags that are not container-specific must be specified before
        --container.

     --description=DESCRIPTION
        Provides an optional, human-readable description of the service.

     --gpu-type=GPU_TYPE
        The GPU type to use.

     --[no-]gpu-zonal-redundancy
        Set GPU zonal redundancy. Use --gpu-zonal-redundancy to enable and
        --no-gpu-zonal-redundancy to disable.

     --instances=INSTANCES
        The number of instances to run for this WorkerPool. Flag value should
        be a positive integer to configure manual scaling with the given
        integer as a fixed instance count.

     --no-promote
        True to avoid assign instances to the worker revision being deployed.
        Setting this flag assigns any instances assigned to the LATEST revision
        to the specific revision bound to LATEST before the deployment. The
        effect is that the revision being deployed will not receive instance
        split.

        After a deployment with this flag the LATEST revision will not receive
        instances on future deployments. To restore assigning instances to the
        LATEST revision by default, run the gcloud beta run worker-pools
        update-instance-split command with --to-latest.

     --remove-containers=[CONTAINER,...]
        List of containers to remove.

     --revision-suffix=REVISION_SUFFIX
        Specify the suffix of the revision name. Revision names always start
        with the service name automatically. For example, specifying
        [--revision-suffix=v1] for a service named 'helloworld', would lead to
        a revision named 'helloworld-v1'. Set empty string to clear the suffix
        and resume server-assigned naming.

     --service-account=SERVICE_ACCOUNT
        the email address of an IAM service account associated with the
        revision of the service. The service account represents the identity of
        the running revision, and determines what permissions the revision has.

     --vpc-egress=VPC_EGRESS
        Specify which of the outbound traffic to send through Direct VPC egress
        or the VPC connector for this resource. This resource must have Direct
        VPC egress enabled or a VPC connector to set this flag. VPC_EGRESS must
        be one of:

         all
            (DEPRECATED) Sends all outbound traffic through Direct VPC egress
            or the VPC connector. Provides the same functionality as
            'all-traffic'. Prefer to use 'all-traffic' instead.
         all-traffic
            Sends all outbound traffic through Direct VPC egress or the VPC
            connector.
         private-ranges-only
            Default option. Sends outbound traffic to private IP addresses (RFC
            1918 and Private Google Access IPs) through Direct VPC egress or
            the VPC connector.

            Traffic to other Cloud Run services might require additional
            configuration. See
            https://cloud.google.com/run/docs/securing/private-networking#send_requests_to_other_services_and_services
            for more information.

     These flags modify the Cloud SQL instances this WorkerPool connects to.
     You can specify a name of a Cloud SQL instance if it's in the same project
     and region as your Cloud Run worker pool; otherwise specify
     <project>:<region>:<instance> for the instance.

     At most one of these can be specified:

       --add-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
          Append the given values to the current Cloud SQL instances.

       --clear-cloudsql-instances
          Empty the current Cloud SQL instances.

       --remove-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
          Remove the given values from the current Cloud SQL instances.

       --set-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
          Completely replace the current Cloud SQL instances with the given
          values.

     --add-volume=[KEY=VALUE,...]
        Adds a volume to the Cloud Run resource. To add more than one volume,
        specify this flag multiple times. Volumes must have a type key. Volumes
        must have a name key if mount-path is not specified. A name key is
        optional if mount-path is specified.Only certain values are supported
        for type. Depending on the provided type, other keys will be required.
        The following types are supported with the specified additional keys:

        cloud-storage: A volume representing a Cloud Storage bucket. This
        volume type is mounted using Cloud Storage FUSE. See
        https://cloud.google.com/storage/docs/gcs-fuse for the details and
        limitations of this filesystem. Additional keys:
        ◆ bucket: (required) the name of the bucket to use as the source of
          this volume
        ◆ readonly: (optional) A boolean. If true, this volume will be
          read-only from all mounts.
        ◆ mount-options: (optional) A list of flags to pass to GCSFuse. Flags
          should be specified without leading dashes and separated by
          semicolons.
        ◆ mount-path: (optional) The path at which the volume should be
          mounted. The mount-path parameter is only supported for single
          container services which do not make use of the --container flag. For
          multi-container services, specify the mount-path parameter under the
          --add-volume-mount flag.

        ephemeral-disk: A volume that stores data on a temporary disk. With
        this type of volume, data is not shared between instances and all data
        will be lost when the instance it is on is terminated. Additional keys:
        ◆ mount-path: (optional) The path at which the volume should be
          mounted. The mount-path parameter is only supported for single
          container services which do not make use of the --container flag. For
          multi-container services, specify the mount-path parameter under the
          --add-volume-mount flag.
        ◆ size: (optional) A quantity representing the amount of disk space
          allocated to this volume, such as "10Gi" or "100G".

        in-memory: An ephemeral volume that stores data in the instance's
        memory. With this type of volume, data is not shared between instances
        and all data will be lost when the instance it is on is terminated.
        Additional keys:
        ◆ mount-path: (optional) The path at which the volume should be
          mounted. The mount-path parameter is only supported for single
          container services which do not make use of the --container flag. For
          multi-container services, specify the mount-path parameter under the
          --add-volume-mount flag.
        ◆ size-limit: (optional) A quantity representing the maximum amount
          of memory allocated to this volume, such as "512Mi" or "3G". Data
          stored in an in-memory volume consumes the memory allocation of the
          container that wrote the data. If size-limit is not specified, the
          maximum size will be half the total memory limit of all containers.

        nfs: Represents a volume backed by an NFS server. Additional keys:
        ◆ location: (required) The location of the NFS Server, in the form
          SERVER:/PATH
        ◆ mount-path: (optional) The path at which the volume should be
          mounted. The mount-path parameter is only supported for single
          container services which do not make use of the --container flag. For
          multi-container services, specify the mount-path parameter under the
          --add-volume-mount flag.
        ◆ readonly: (optional) A boolean. If true, this volume will be
          read-only from all mounts.

     --clear-volumes
        Remove all existing volumes from the Cloud Run resource, including
        volumes mounted as secrets

     --remove-volume=[VOLUME,...]
        Removes volumes from the Cloud Run resource.

    Container Flags

        The following flags apply to the container.

     --add-volume-mount=[volume=NAME,mount-path=MOUNT_PATH,...]
        Adds a mount to the current container. Must contain the keys
        volume=NAME and mount-path=/PATH where NAME is the name of a volume on
        this resource and PATH is the path within the container's filesystem to
        mount this volume.

     --args=[ARG,...]
        Comma-separated arguments passed to the command run by the container
        image. If not specified and no '--command' is provided, the container
        image's default Cmd is used. Otherwise, if not specified, no arguments
        are passed. To reset this field to its default, pass an empty string.

     --clear-volume-mounts
        Remove all existing mounts from the current container.

     --command=[COMMAND,...]
        Entrypoint for the container image. If not specified, the container
        image's default Entrypoint is run. To reset this field to its default,
        pass an empty string.

     --cpu=CPU
        Set a CPU limit in Kubernetes cpu units.

        Cloud Run supports values fractional values below 1, 1, 2, 4, and 8.
        Some CPU values requires a minimum Memory --memory value.

     --depends-on=[CONTAINER,...]
        List of container dependencies to add to the current container.

     --gpu=GPU
        Cloud Run supports values 0 or 1. 1 gpu also requires a minimum 4 --cpu
        value and a minimum 16Gi --memory value.

     --memory=MEMORY
        Set a memory limit. Ex: 1024Mi, 4Gi.

     --remove-volume-mount=[MOUNT_PATH,...]
        Removes the volume mounted at the specified path from the current
        container.

     --workdir=WORKDIR
        Working directory of the container process. If not specified, the
        container image's default working directory is used. To reset this
        field to its default, pass an empty string.

     At most one of these can be specified:

       --clear-env-vars
          Remove all environment variables.

       --env-vars-file=FILE_PATH
          Path to a local YAML or ENV file with definitions for all environment
          variables. All existing environment variables will be removed before
          the new environment variables are added. Example YAML content:

              KEY_1: "value1"
              KEY_2: "value 2"

          Example ENV content:

              KEY_1="value1"
              KEY_2="value 2"

       --set-env-vars=[KEY=VALUE,...]
          List of key-value pairs to set as environment variables. All existing
          environment variables will be removed first.

       Or at least one of these can be specified:

         Only --update-env-vars and --remove-env-vars can be used together. If
         both are specified, --remove-env-vars will be applied first.

         --remove-env-vars=[KEY,...]
            List of environment variables to be removed.

         --update-env-vars=[KEY=VALUE,...]
            List of key-value pairs to set as environment variables.

     Specify secrets to provide as environment variables. For example:
     '--set-secrets=ENV=mysecret:latest,OTHER_ENV=othersecret:1' will create an
     environment variable named ENV whose value is the latest version of secret
     'mysecret' and an environment variable OTHER_ENV whose value is version of
     1 of secret 'othersecret'.

     At most one of these can be specified:

       --clear-secrets
          Remove all secrets.

       --set-secrets=[KEY=VALUE,...]
          List of key-value pairs to set as secrets. All existing secrets will
          be removed first.

       Or at least one of these can be specified:

         Only --update-secrets and --remove-secrets can be used together. If
         both are specified, --remove-secrets will be applied first.

         --remove-secrets=[KEY,...]
            List of secrets to be removed.

         --update-secrets=[KEY=VALUE,...]
            List of key-value pairs to set as secrets.

     At most one of these can be specified:

       --image=IMAGE
          Name of the container image to deploy (e.g.
          us-docker.pkg.dev/cloudrun/container/hello:latest).

       --source=SOURCE
          The location of the source to build. If a Dockerfile is present in
          the source code directory, it will be built using that Dockerfile,
          otherwise it will use Google Cloud buildpacks. See
          https://cloud.google.com/run/docs/deploying-source-code for more
          details. The location can be a directory on a local disk or a gzipped
          archive file (.tar.gz) in Google Cloud Storage. If the source is a
          local directory, this command skips the files specified in the
          --ignore-file. If --ignore-file is not specified, use .gcloudignore
          file. If a .gcloudignore file is absent and a .gitignore file is
          present in the local source directory, gcloud will use a generated
          Git-compatible .gcloudignore file that respects your .gitignored
          files. The global .gitignore is not respected. For more information
          on .gcloudignore, see gcloud topic gcloudignore.

     At most one of these can be specified:

       --binary-authorization=POLICY
          Binary Authorization policy to check against. This must be set to
          "default".

       --clear-binary-authorization
          Remove any previously set Binary Authorization policy.

     At most one of these can be specified:

       --clear-encryption-key-shutdown-hours
          Remove any previously set CMEK key shutdown hours setting.

       --encryption-key-shutdown-hours=ENCRYPTION_KEY_SHUTDOWN_HOURS
          The number of hours to wait before an automatic shutdown server after
          CMEK key revocation is detected.

     At most one of these can be specified:

       --clear-key
          Remove any previously set CMEK key reference.

       --key=KEY
          CMEK key reference to encrypt the container with.

     At most one of these can be specified:

       --clear-labels
          Remove all labels. If --update-labels is also specified then
          --clear-labels is applied first.

          For example, to remove all labels:

              $ gcloud beta run worker-pools deploy --clear-labels

          To remove all existing labels and create two new labels, foo and baz:

              $ gcloud beta run worker-pools deploy --clear-labels \
                --update-labels foo=bar,baz=qux

       --remove-labels=[KEY,...]
          List of label keys to remove. If a label does not exist it is
          silently ignored. If --update-labels is also specified then
          --update-labels is applied first.

     At most one of these can be specified:

       --labels=[KEY=VALUE,...]
          List of label KEY=VALUE pairs to add.

          An alias to --update-labels.

       --update-labels=[KEY=VALUE,...]
          List of label KEY=VALUE pairs to update. If a label exists, its value
          is modified. Otherwise, a new label is created.

     At most one of these can be specified:

       --clear-network
          Disconnect this Cloud Run worker from the VPC network it is connected
          to.

       Or at least one of these can be specified:

         Direct VPC egress setting flags group.

         --network=NETWORK
            The VPC network that the Cloud Run worker will be able to send
            traffic to. If --subnet is also specified, subnet must be a
            subnetwork of the network specified by this --network flag. To
            clear existing VPC network settings, use --clear-network.

         --subnet=SUBNET
            The VPC subnetwork that the Cloud Run worker will get IPs from. The
            subnetwork must be /26 or larger. If --network is also specified,
            subnet must be a subnetwork of the network specified by the
            --network flag. If --network is not specified, network will be
            looked up from this subnetwork. To clear existing VPC network
            settings, use --clear-network.

         At most one of these can be specified:

           --clear-network-tags
              Clears all existing network tags from the Cloud Run worker.

           --network-tags=[TAG,...]
              Applies the given network tags (comma separated) to the Cloud Run
              worker. To clear existing tags, use --clear-network-tags.

     At most one of these can be specified:

       --clear-post-key-revocation-action-type
          Remove any previously set post CMEK key revocation action type.

       --post-key-revocation-action-type=POST_KEY_REVOCATION_ACTION_TYPE
          Action type after CMEK key revocation.
          POST_KEY_REVOCATION_ACTION_TYPE must be one of:

           prevent-new
              No new instances will be started after CMEK key revocation.
           shut-down
              No new instances will be started and the existing instances will
              be shut down after CMEK key revocation.

GCLOUD WIDE FLAGS
    These flags are available to all commands: --access-token-file, --account,
    --billing-project, --configuration, --flags-file, --flatten, --format,
    --help, --impersonate-service-account, --log-http, --project, --quiet,
    --trace-token, --user-output-enabled, --verbosity.

    Run $ gcloud help for details.

NOTES
    This command is currently in beta and might change without notice. These
    variants are also available:

        $ gcloud run worker-pools deploy

        $ gcloud alpha run worker-pools deploy