From 032d6059abc5fcc4337cb3adc4136fbee5c21198 Mon Sep 17 00:00:00 2001 From: seanbollin Date: Thu, 27 Aug 2026 14:19:22 -0700 Subject: [PATCH] Requiring customer to set runner SA --- .../serverless-workers/cloud-run/index.mdx | 8 +++----- .../serverless-workers/cloud-run/self-hosted-setup.mdx | 2 ++ 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/production-deployment/worker-deployments/serverless-workers/cloud-run/index.mdx b/docs/production-deployment/worker-deployments/serverless-workers/cloud-run/index.mdx index 8e3e11b6d0..9c00b6abb3 100644 --- a/docs/production-deployment/worker-deployments/serverless-workers/cloud-run/index.mdx +++ b/docs/production-deployment/worker-deployments/serverless-workers/cloud-run/index.mdx @@ -662,9 +662,7 @@ scale the pool but never runs it. Use a dedicated service account for the pool, and [create one](https://cloud.google.com/iam/docs/service-accounts-create) if you do not already have a suitable account. -If you omit `--service-account`, Cloud Run falls back to the -[default Compute Engine service account](https://cloud.google.com/run/docs/securing/service-identity), which holds -`roles/editor`. You need the email twice: here, and in [Step 3](#configure-iam) as `runner_service_account_email`. +You need the email twice: here, and in [Step 3](#configure-iam) as `runner_service_account_email`. Store the Temporal Cloud API key (or TLS material) in Secret Manager rather than passing it as a plaintext environment variable. @@ -715,7 +713,7 @@ This guide uses two service accounts, and they are not interchangeable: - The **runner service account** is the identity the Worker Pool runs as. You set it in [Step 2](#create-worker-pool) with `gcloud run worker-pools deploy --service-account`, and it can be an account you - already have. Omit the flag and Cloud Run uses the project's default Compute Engine service account. + already have. - The **invoker service account** is the identity Temporal impersonates to read and scale the pool. The Terraform module below creates it, and its email is the `invoker_email` output you give Temporal in [Step 4](#create-worker-deployment-version). @@ -752,7 +750,7 @@ Set these variables: | `project_id` | Yes | The GCP project that hosts the Worker Pool and the invoker service account. | | `invoker_account_id` | Yes | A name for the invoker service account the module creates. The full email becomes `@.iam.gserviceaccount.com`. The template supplies a name, so change it only if you want a different one. | | `impersonator_service_account_emails` | Yes | Temporal Cloud's service accounts, granted `roles/iam.serviceAccountTokenCreator` on the invoker service account so they can impersonate it. Filled in by the template in the UI. | -| `runner_service_account_email` | No | The [runner service account](#runner-service-account) from [Step 2](#create-worker-pool). The module grants the invoker service account `roles/iam.serviceAccountUser` on it, which Cloud Run requires to attach that identity when it scales the pool. Leave it unset and the invoker service account gets that grant on the default Compute Engine service account instead. | +| `runner_service_account_email` | Yes | The [runner service account](#runner-service-account) from [Step 2](#create-worker-pool). The module grants the invoker service account `roles/iam.serviceAccountUser` on it, which Cloud Run requires to attach that identity when it scales the pool. | | `invoker_display_name` | No | Display name for the invoker service account. Defaults to `Temporal Serverless Worker Pool Invoker`. | | `deploy_roles` | No | Project-level Cloud Run roles granted to the invoker service account. Defaults to `roles/run.developer`. Any role you use instead must include `run.workerPools.get` and `run.workerPools.update`. | diff --git a/docs/production-deployment/worker-deployments/serverless-workers/cloud-run/self-hosted-setup.mdx b/docs/production-deployment/worker-deployments/serverless-workers/cloud-run/self-hosted-setup.mdx index c535d31961..61f2a7b47a 100644 --- a/docs/production-deployment/worker-deployments/serverless-workers/cloud-run/self-hosted-setup.mdx +++ b/docs/production-deployment/worker-deployments/serverless-workers/cloud-run/self-hosted-setup.mdx @@ -123,6 +123,8 @@ module "serverless-worker-cloud-run" { project_id = "" invoker_account_id = "temporal-serverless-worker" + runner_service_account_email = "" + impersonator_service_account_emails = [ "", ]