gcloud-help/gcloud/alpha/run/instances/create

NAME
    gcloud alpha run instances create - create a Cloud Run instance

SYNOPSIS
    gcloud alpha run instances create [INSTANCE] [--async]
        [--binary-authorization=POLICY] [--breakglass=JUSTIFICATION]
        [--container=CONTAINER] [--gpu-type=GPU_TYPE]
        [--[no-]gpu-zonal-redundancy] [--ingress=INGRESS; default="all"]
        [--[no-]invoker-iam-check] [--key=KEY] [--labels=[KEY=VALUE,...]]
        [--region=REGION] [--service-account=SERVICE_ACCOUNT]
        [--set-cloudsql-instances=[CLOUDSQL-INSTANCES,...]]
        [--vpc-connector=VPC_CONNECTOR] [--vpc-egress=VPC_EGRESS]
        [--add-volume=[KEY=VALUE,...]
          --clear-volumes --remove-volume=[VOLUME,...]]
        [--add-volume-mount=[volume=NAME,mount-path=MOUNT_PATH,...]
          --args=[ARG,...] --clear-volume-mounts --command=[COMMAND,...]
          --cpu=CPU --depends-on=[CONTAINER,...] --gpu=GPU --image=IMAGE
          --memory=MEMORY --port=PORT --remove-volume-mount=[MOUNT_PATH,...]
          --startup-probe=[KEY=VALUE,...] --clear-env-vars
          | --env-vars-file=FILE_PATH | --set-env-vars=[KEY=VALUE,...]
          | --remove-env-vars=[KEY,...]
          --update-env-vars=[KEY=VALUE,...] --clear-secrets
          | --set-secrets=[KEY=VALUE,...]
          | --remove-secrets=[KEY,...] --update-secrets=[KEY=VALUE,...]]
        [--network=NETWORK --network-tags=[TAG,...] --subnet=SUBNET]
        [GCLOUD_WIDE_FLAG ...]

DESCRIPTION
    (ALPHA) Creates a new Cloud Run instance.

EXAMPLES
    To create a new instance my-instance on Cloud Run:

        $ gcloud alpha run instances create my-instance \
          --image=us-docker.pkg.dev/project/image

    You may also omit the instance name. Then a prompt will be displayed with a
    suggested default value:

        $ gcloud alpha run instances create \
          --image=us-docker.pkg.dev/project/image

POSITIONAL ARGUMENTS
     Instance resource - Instance to create. This represents a Cloud resource.
     (NOTE) Some attributes are not given arguments in this group but can be
     set in other ways.

     To set the project attribute:
      ◆ provide the argument INSTANCE on the command line with a fully
        specified name;
      ◆ specify the instance name from an interactive prompt with a fully
        specified name;
      ◆ provide the argument --project on the command line;
      ◆ set the property core/project.

     [INSTANCE]
        ID of the Instance or fully qualified identifier for the Instance.

        To set the instances attribute:
        ◆ provide the argument INSTANCE on the command line;
        ◆ specify the instance name from an interactive prompt.

FLAGS
     --async
        Return immediately, without waiting for the operation in progress to
        complete.

     --binary-authorization=POLICY
        Binary Authorization policy to check against. This must be set to
        "default".

     --breakglass=JUSTIFICATION
        Justification to bypass Binary Authorization policy constraints and
        allow the operation. See
        https://cloud.google.com/binary-authorization/docs/using-breakglass for
        more information. Next update or deploy command will automatically
        clear existing breakglass justification.

     --container=CONTAINER
        Specifies a container by name. Flags following --container will apply
        to the specified container.

        Flags that are not container-specific must be specified before
        --container.

     --gpu-type=GPU_TYPE
        The GPU type to use.

     --[no-]gpu-zonal-redundancy
        Set GPU zonal redundancy. Use --gpu-zonal-redundancy to enable and
        --no-gpu-zonal-redundancy to disable.

     --ingress=INGRESS; default="all"
        Set the ingress traffic sources allowed to call the service. For Cloud
        Run the --[no-]allow-unauthenticated flag separately controls the
        identities allowed to call the service. INGRESS must be one of:

         all
            Inbound requests from all sources are allowed.
         internal
            For Cloud Run, only inbound requests from VPC networks in the same
            project or VPC Service Controls perimeter, as well as Pub/Sub
            subscriptions and Eventarc events in the same project or VPC
            Service Controls perimeter are allowed. All other requests are
            rejected. See https://cloud.google.com/run/docs/securing/ingress
            for full details on the definition of internal traffic for Cloud
            Run.

         internal-and-cloud-load-balancing
            Only inbound requests from Google Cloud Load Balancing or a traffic
            source allowed by the internal option are allowed.

     --[no-]invoker-iam-check
        Optionally disable invoker IAM checks. More info at
        https://cloud.google.com/run/docs/securing/managing-access#invoker_check.
        Use --invoker-iam-check to enable and --no-invoker-iam-check to
        disable.

     --key=KEY
        CMEK key reference to encrypt the container with.

     --labels=[KEY=VALUE,...]
        List of label KEY=VALUE pairs to add.

     --region=REGION
        Region in which the resource can be found. Alternatively, set the
        property [run/region].

     --service-account=SERVICE_ACCOUNT
        the email address of an IAM service account associated with the
        revision of the service. The service account represents the identity of
        the running revision, and determines what permissions the revision has.

     --set-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
        You can specify a name of a Cloud SQL instance if it's in the same
        project and region as your Cloud Run resource; otherwise specify
        <project>:<region>:<instance> for the instance.

     --vpc-connector=VPC_CONNECTOR
        Set a VPC connector for this resource.

     --vpc-egress=VPC_EGRESS
        Specify which of the outbound traffic to send through Direct VPC egress
        or the VPC connector for this resource. This resource must have Direct
        VPC egress enabled or a VPC connector to set this flag. VPC_EGRESS must
        be one of:

         all
            (DEPRECATED) Sends all outbound traffic through Direct VPC egress
            or the VPC connector. Provides the same functionality as
            'all-traffic'. Prefer to use 'all-traffic' instead.
         all-traffic
            Sends all outbound traffic through Direct VPC egress or the VPC
            connector.
         private-ranges-only
            Default option. Sends outbound traffic to private IP addresses (RFC
            1918 and Private Google Access IPs) through Direct VPC egress or
            the VPC connector.

            Traffic to other Cloud Run services might require additional
            configuration. See
            https://cloud.google.com/run/docs/securing/private-networking#send_requests_to_other_services_and_services
            for more information.

     --add-volume=[KEY=VALUE,...]
        Adds a volume to the Cloud Run resource. To add more than one volume,
        specify this flag multiple times. Volumes must have a type key. Volumes
        must have a name key if mount-path is not specified. A name key is
        optional if mount-path is specified.Only certain values are supported
        for type. Depending on the provided type, other keys will be required.
        The following types are supported with the specified additional keys:

        cloud-storage: A volume representing a Cloud Storage bucket. This
        volume type is mounted using Cloud Storage FUSE. See
        https://cloud.google.com/storage/docs/gcs-fuse for the details and
        limitations of this filesystem. Additional keys:
        ◆ readonly: (optional) A boolean. If true, this volume will be
          read-only from all mounts.
        ◆ mount-options: (optional) A list of flags to pass to GCSFuse. Flags
          should be specified without leading dashes and separated by
          semicolons.
        ◆ bucket: (optional) the name of the bucket to use as the source of
          this volume.
        ◆ dynamic-mounting: (optional) A boolean. If true, the volume will be
          mounted dynamically. Note: You will either need to specify a bucket
          or set dynamic-mounting to true, but not both.
        ◆ mount-path: (optional) The path at which the volume should be
          mounted. The mount-path parameter is only supported for single
          container services which do not make use of the --container flag. For
          multi-container services, specify the mount-path parameter under the
          --add-volume-mount flag.

        cloudsql: Represents a Cloud SQL instance as a volume. Additional keys:
        ◆ instances: (required) The name of the Cloud SQL instances to mount.
          Must be in the form project_id:region:instance_id and separated by
          semicolons.
        ◆ mount-path: (optional) The path at which the volume should be
          mounted. The mount-path parameter is only supported for single
          container services which do not make use of the --container flag. For
          multi-container services, specify the mount-path parameter under the
          --add-volume-mount flag.

        ephemeral-disk: A volume that stores data on a temporary disk. With
        this type of volume, data is not shared between instances and all data
        will be lost when the instance it is on is terminated. Additional keys:
        ◆ mount-path: (optional) The path at which the volume should be
          mounted. The mount-path parameter is only supported for single
          container services which do not make use of the --container flag. For
          multi-container services, specify the mount-path parameter under the
          --add-volume-mount flag.
        ◆ size: (optional) A quantity representing the amount of disk space
          allocated to this volume, such as "512Mi" or "3G".

        in-memory: An ephemeral volume that stores data in the instance's
        memory. With this type of volume, data is not shared between instances
        and all data will be lost when the instance it is on is terminated.
        Additional keys:
        ◆ mount-path: (optional) The path at which the volume should be
          mounted. The mount-path parameter is only supported for single
          container services which do not make use of the --container flag. For
          multi-container services, specify the mount-path parameter under the
          --add-volume-mount flag.
        ◆ size-limit: (optional) A quantity representing the maximum amount
          of memory allocated to this volume, such as "512Mi" or "3G". Data
          stored in an in-memory volume consumes the memory allocation of the
          container that wrote the data. If size-limit is not specified, the
          maximum size will be half the total memory limit of all containers.

        nfs: Represents a volume backed by an NFS server. Additional keys:
        ◆ location: (required) The location of the NFS Server, in the form
          SERVER:/PATH
        ◆ mount-path: (optional) The path at which the volume should be
          mounted. The mount-path parameter is only supported for single
          container services which do not make use of the --container flag. For
          multi-container services, specify the mount-path parameter under the
          --add-volume-mount flag.
        ◆ readonly: (optional) A boolean. If true, this volume will be
          read-only from all mounts.

        secret: Represents a secret stored in Secret Manager as a volume.
        Additional keys:
        ◆ secret: (required) The name of the secret in Secret Manager. Must
          be a secret in the same project being deployed or be an alias mapped
          in the run.googleapis.com/secrets annotation.
        ◆ version: (required) The version of the secret to make available in
          the volume.
        ◆ path: (required) The relative path within the volume to mount that
          version.
        ◆ mount-path: (optional) The path at which the volume should be
          mounted. The mount-path parameter is only supported for single
          container services which do not make use of the --container flag. For
          multi-container services, specify the mount-path parameter under the
          --add-volume-mount flag.

     --clear-volumes
        Remove all existing volumes from the Cloud Run resource, including
        volumes mounted as secrets

     --remove-volume=[VOLUME,...]
        Removes volumes from the Cloud Run resource.

    Container Flags

        If the --container is specified the following arguments may only be specified after a --container flag.

     --add-volume-mount=[volume=NAME,mount-path=MOUNT_PATH,...]
        Adds a mount to the current container. Must contain the keys
        volume=NAME and mount-path=/PATH where NAME is the name of a volume on
        this resource and PATH is the path within the container's filesystem to
        mount this volume.

     --args=[ARG,...]
        Comma-separated arguments passed to the command run by the container
        image. If not specified and no '--command' is provided, the container
        image's default Cmd is used. Otherwise, if not specified, no arguments
        are passed. To reset this field to its default, pass an empty string.

     --clear-volume-mounts
        Remove all existing mounts from the current container.

     --command=[COMMAND,...]
        Entrypoint for the container image. If not specified, the container
        image's default Entrypoint is run. To reset this field to its default,
        pass an empty string.

     --cpu=CPU
        Set a CPU limit in Kubernetes cpu units.

        Cloud Run supports values fractional values below 1, 1, 2, 4, and 8.
        Some CPU values requires a minimum Memory --memory value.

     --depends-on=[CONTAINER,...]
        List of container dependencies to add to the current container.

     --gpu=GPU
        Cloud Run supports values 0 or 1. 1 gpu also requires a minimum 4 --cpu
        value and a minimum 16Gi --memory value.

     --image=IMAGE
        Name of the container image to deploy (e.g.
        us-docker.pkg.dev/cloudrun/container/hello:latest).

     --memory=MEMORY
        Set a memory limit. Ex: 1024Mi, 4Gi.

     --port=PORT
        Container port to receive requests at. Also sets the $PORT environment
        variable. Must be a number between 1 and 65535, inclusive. To unset
        this field, pass the special value "default". If updating an existing
        service with a TCP startup probe pointing to the previous container
        port, this will also update the probe port.

     --remove-volume-mount=[MOUNT_PATH,...]
        Removes the volume mounted at the specified path from the current
        container.

     --startup-probe=[KEY=VALUE,...]
        Comma separated settings for startup probe in the form KEY=VALUE. Each
        key stands for a field of the probe described in
        https://cloud.google.com/run/docs/reference/rest/v1/Container#Probe.
        Currently supported keys are: initialDelaySeconds, timeoutSeconds,
        periodSeconds, failureThreshold, httpGet.port, httpGet.path, grpc.port,
        grpc.service, tcpSocket.port.

        For example, to set a probe with 10s timeout and HTTP probe requests
        sent to 8080 port of the container:

            $ --startup-probe=timeoutSeconds=10,httpGet.port=8080

        To remove existing probe:

            $ --startup-probe=""

     At most one of these can be specified:

       --clear-env-vars
          Remove all environment variables.

       --env-vars-file=FILE_PATH
          Path to a local YAML or ENV file with definitions for all environment
          variables. All existing environment variables will be removed before
          the new environment variables are added. Example YAML content:

              KEY_1: "value1"
              KEY_2: "value 2"

          Example ENV content:

              KEY_1="value1"
              KEY_2="value 2"

       --set-env-vars=[KEY=VALUE,...]
          List of key-value pairs to set as environment variables. All existing
          environment variables will be removed first.

       Or at least one of these can be specified:

         Only --update-env-vars and --remove-env-vars can be used together. If
         both are specified, --remove-env-vars will be applied first.

         --remove-env-vars=[KEY,...]
            List of environment variables to be removed.

         --update-env-vars=[KEY=VALUE,...]
            List of key-value pairs to set as environment variables.

     Specify secrets to mount or provide as environment variables. Keys
     starting with a forward slash '/' are mount paths. All other keys
     correspond to environment variables. Values should be in the form
     SECRET_NAME:SECRET_VERSION. For example:
     '--update-secrets=/secrets/api/key=mysecret:latest,ENV=othersecret:1' will
     mount a volume at '/secrets/api' containing a file 'key' with the latest
     version of secret 'mysecret'. An environment variable named ENV will also
     be created whose value is version 1 of secret 'othersecret'.

     At most one of these can be specified:

       --clear-secrets
          Remove all secrets.

       --set-secrets=[KEY=VALUE,...]
          List of key-value pairs to set as secrets. All existing secrets will
          be removed first.

       Or at least one of these can be specified:

         Only --update-secrets and --remove-secrets can be used together. If
         both are specified, --remove-secrets will be applied first.

         --remove-secrets=[KEY,...]
            List of secrets to be removed.

         --update-secrets=[KEY=VALUE,...]
            List of key-value pairs to set as secrets.

     Direct VPC egress setting flags group.

     --network=NETWORK
        The VPC network that the Cloud Run job will be able to send traffic to.
        If --subnet is also specified, subnet must be a subnetwork of the
        network specified by this --network flag. To clear existing VPC network
        settings, use --clear-network.

     --network-tags=[TAG,...]
        Applies the given network tags (comma separated) to the Cloud Run job.
        To clear existing tags, use --clear-network-tags.

     --subnet=SUBNET
        The VPC subnetwork that the Cloud Run job will get IPs from. The
        subnetwork must be /26 or larger. If --network is also specified,
        subnet must be a subnetwork of the network specified by the --network
        flag. If --network is not specified, network will be looked up from
        this subnetwork. To clear existing VPC network settings, use
        --clear-network.

GCLOUD WIDE FLAGS
    These flags are available to all commands: --access-token-file, --account,
    --billing-project, --configuration, --flags-file, --flatten, --format,
    --help, --impersonate-service-account, --log-http, --project, --quiet,
    --trace-token, --user-output-enabled, --verbosity.

    Run $ gcloud help for details.

NOTES
    This command is currently in alpha and might change without notice. If this
    command fails with API permission errors despite specifying the correct
    project, you might be trying to access an API with an invitation-only early
    access allowlist.