Google Cloud Run Deployment

# GCP Cloud Run

You are an expert in Google Cloud Run for deploying containerized applications with automatic scaling.

## Key Principles
- Design containers for stateless, request-driven workloads
- Optimize container startup time for cold start performance
- Use Cloud Run services for HTTP, jobs for batch processing
- Implement proper health checks and graceful shutdown
- Leverage managed services for state (Cloud SQL, Firestore, Redis)

## Container Optimization
```dockerfile
# Optimized Dockerfile for Cloud Run
FROM python:3.12-slim AS builder

WORKDIR /app

# Install dependencies in builder stage
COPY requirements.txt .
RUN pip install --no-cache-dir --user -r requirements.txt

# Production image
FROM python:3.12-slim

WORKDIR /app

# Copy only necessary files
COPY --from=builder /root/.local /root/.local
COPY ./src ./src

# Ensure scripts in .local are usable
ENV PATH=/root/.local/bin:$PATH

# Cloud Run sets PORT environment variable
ENV PORT=8080

# Use non-root user for security
RUN useradd -m appuser && chown -R appuser:appuser /app
USER appuser

# Use exec form for proper signal handling
CMD ["python", "-m", "uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8080"]
```

## Application Setup (FastAPI)
```python
from fastapi import FastAPI, Request, HTTPException
from fastapi.responses import JSONResponse
from contextlib import asynccontextmanager
import signal
import asyncio
import os

# Global state for graceful shutdown
shutdown_event = asyncio.Event()

@asynccontextmanager
async def lifespan(app: FastAPI):
    """Manage application lifecycle."""
    # Startup
    await initialize_connections()
    
    yield
    
    # Shutdown - graceful cleanup
    await cleanup_connections()

app = FastAPI(lifespan=lifespan)

# Handle SIGTERM for graceful shutdown
def handle_sigterm(*args):
    shutdown_event.set()

signal.signal(signal.SIGTERM, handle_sigterm)

@app.get("/health")
async def health_check():
    """Liveness probe endpoint."""
    return {"status": "healthy"}

@app.get("/ready")
async def readiness_check():
    """Readiness probe - check dependencies."""
    try:
        await check_database_connection()
        return {"status": "ready"}
    except Exception as e:
        raise HTTPException(status_code=503, detail="Not ready")

@app.middleware("http")
async def check_shutdown(request: Request, call_next):
    """Reject new requests during shutdown."""
    if shutdown_event.is_set():
        return JSONResponse(
            status_code=503,
            content={"detail": "Service shutting down"}
        )
    return await call_next(request)
```

## Cloud Run Service Configuration
```yaml
# service.yaml
apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: my-service
  annotations:
    run.googleapis.com/ingress: all
    run.googleapis.com/launch-stage: BETA
spec:
  template:
    metadata:
      annotations:
        autoscaling.knative.dev/minScale: "0"
        autoscaling.knative.dev/maxScale: "100"
        run.googleapis.com/cpu-throttling: "false"
        run.googleapis.com/startup-cpu-boost: "true"
        run.googleapis.com/execution-environment: gen2
    spec:
      containerConcurrency: 80
      timeoutSeconds: 300
      serviceAccountName: my-service@project.iam.gserviceaccount.com
      containers:
        - image: gcr.io/project/my-service:latest
          ports:
            - containerPort: 8080
          resources:
            limits:
              cpu: "2"
              memory: 2Gi
          env:
            - name: PROJECT_ID
              value: my-project
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: db-password
                  key: latest
          startupProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 0
            periodSeconds: 1
            failureThreshold: 30
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            periodSeconds: 10
```

## Cloud Run Jobs
```python
# Job for batch processing
import os
from google.cloud import tasks_v2
from google.cloud import storage

def main():
    """Cloud Run Job entry point."""
    
    # Get job metadata
    task_index = int(os.environ.get('CLOUD_RUN_TASK_INDEX', 0))
    task_count = int(os.environ.get('CLOUD_RUN_TASK_COUNT', 1))
    
    # Process batch assigned to this task
    items = get_items_for_task(task_index, task_count)
    
    for item in items:
        process_item(item)
    
    print(f"Task {task_index} completed, processed {len(items)} items")

def get_items_for_task(task_index: int, task_count: int) -> list:
    """Get items assigned to this task instance."""
    all_items = fetch_all_items()
    
    # Distribute items across tasks
    items_per_task = len(all_items) // task_count
    start = task_index * items_per_task
    end = start + items_per_task if task_index < task_count - 1 else len(all_items)
    
    return all_items[start:end]

if __name__ == "__main__":
    main()
```

## Terraform Deployment
```hcl
# Cloud Run service with VPC connector
resource "google_cloud_run_v2_service" "main" {
  name     = "my-service"
  location = "us-central1"
  ingress  = "INGRESS_TRAFFIC_ALL"

  template {
    scaling {
      min_instance_count = 0
      max_instance_count = 100
    }

    vpc_access {
      connector = google_vpc_access_connector.connector.id
      egress    = "PRIVATE_RANGES_ONLY"
    }

    containers {
      image = "gcr.io/${var.project_id}/my-service:${var.image_tag}"
      
      ports {
        container_port = 8080
      }

      resources {
        limits = {
          cpu    = "2"
          memory = "2Gi"
        }
        cpu_idle = false  # Always-on CPU
        startup_cpu_boost = true
      }

      env {
        name  = "PROJECT_ID"
        value = var.project_id
      }

      env {
        name = "DB_PASSWORD"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.db_password.secret_id
            version = "latest"
          }
        }
      }

      startup_probe {
        http_get {
          path = "/health"
          port = 8080
        }
        initial_delay_seconds = 0
        period_seconds        = 1
        failure_threshold     = 30
      }

      liveness_probe {
        http_get {
          path = "/health"
          port = 8080
        }
        period_seconds = 10
      }
    }

    service_account = google_service_account.cloud_run.email
  }

  traffic {
    type    = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"
    percent = 100
  }
}

# IAM binding for public access
resource "google_cloud_run_service_iam_member" "public" {
  count    = var.public_access ? 1 : 0
  location = google_cloud_run_v2_service.main.location
  service  = google_cloud_run_v2_service.main.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

# VPC connector for private resources
resource "google_vpc_access_connector" "connector" {
  name          = "cloudrun-connector"
  region        = "us-central1"
  network       = google_compute_network.main.name
  ip_cidr_range = "10.8.0.0/28"
  
  min_instances = 2
  max_instances = 10
}
```

## Authentication Patterns
```python
from google.auth.transport import requests
from google.oauth2 import id_token
from fastapi import Depends, HTTPException, Security
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials

security = HTTPBearer()

async def verify_token(
    credentials: HTTPAuthorizationCredentials = Security(security)
) -> dict:
    """Verify Google ID token from Cloud Run invoker."""
    
    try:
        token = credentials.credentials
        
        # Verify token with Google
        claims = id_token.verify_oauth2_token(
            token,
            requests.Request(),
            audience=os.environ.get('SERVICE_URL')
        )
        
        return claims
        
    except Exception as e:
        raise HTTPException(status_code=401, detail="Invalid token")

@app.get("/protected")
async def protected_endpoint(claims: dict = Depends(verify_token)):
    """Protected endpoint requiring authentication."""
    return {"user": claims.get("email")}
```

## Connecting to Cloud SQL
```python
import sqlalchemy
from google.cloud.sql.connector import Connector
import os

def create_pool():
    """Create connection pool for Cloud SQL."""
    
    connector = Connector()
    
    def getconn():
        return connector.connect(
            os.environ["INSTANCE_CONNECTION_NAME"],
            "pg8000",
            user=os.environ["DB_USER"],
            password=os.environ["DB_PASSWORD"],
            db=os.environ["DB_NAME"],
        )
    
    pool = sqlalchemy.create_engine(
        "postgresql+pg8000://",
        creator=getconn,
        pool_size=5,
        max_overflow=2,
        pool_timeout=30,
        pool_recycle=1800,
    )
    
    return pool

# For private IP connection via VPC
def create_private_pool():
    """Connect via private IP (requires VPC connector)."""
    
    return sqlalchemy.create_engine(
        f"postgresql+pg8000://{os.environ['DB_USER']}:{os.environ['DB_PASSWORD']}"
        f"@{os.environ['DB_PRIVATE_IP']}:5432/{os.environ['DB_NAME']}",
        pool_size=5,
        max_overflow=2,
    )
```

## Cold Start Optimization
- Use startup CPU boost (doubles CPU during startup)
- Minimize container image size (<500MB recommended)
- Use multi-stage Docker builds
- Lazy-load heavy dependencies
- Set min instances > 0 for latency-sensitive services
- Use gen2 execution environment for faster startup

## Anti-Patterns to Avoid
- Don't store state in container filesystem
- Avoid long initialization in container startup
- Don't use Cloud Run for WebSocket connections (use gen2)
- Never hardcode secrets in images
- Avoid synchronous calls to slow external services
- Don't skip graceful shutdown handling