Connect private Cloud Run services to Restate Cloud with workload identity federation - #378
Draft
pcholakov wants to merge 1 commit into
Draft
Connect private Cloud Run services to Restate Cloud with workload identity federation#378pcholakov wants to merge 1 commit into
pcholakov wants to merge 1 commit into
Conversation
Adds a Google Cloud Run section to the Cloud connecting-services page: workload identity federation trust setup (pool/provider pinned to the Restate Cloud federation role, per-environment subject grants) and registration. Updates the Cloud Run deploy page: Restate Cloud is now a supported path rather than a roadmap item, documents --gcp-workload-identity-provider, and refreshes the token-caching description to match the credential registry behavior.
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents connecting private Google Cloud Run services to Restate Cloud via AWS→GCP workload identity federation (restatedev/restate#5207, restatedev/restate-cloud#1188).
Draft until the feature ships: the runtime PRs (restatedev/restate#5154 → #5207 → #5229) and the Cloud broker infrastructure (restate-cloud#1400) are unmerged; the identifiers here (
RestateCloudGcpFederation, account654654156625) are the reserved production values, not yet live.What's here
cloud/connecting-services: new "Google Cloud Run services" section — the identity model (one fixed federated subject per environment, derived from the environment ID), the three IAM grants (provider with a pinned attribute condition,serviceAccountOpenIdTokenCreatoron the customer's invoker SA for the exact subject,run.invoker), and registration. All enforcement lives in the customer's own project IAM; the section says so explicitly since unilateral revocability is the selling point. Commands mirror the E2E-verified sequences.services/deploy/cloud-run: the "not supported on Restate Cloud" Note becomes a pointer to the new section; adds an "AWS-hosted Restate: workload identity federation" subsection documenting--gcp-workload-identity-provider(new in restate#5207, always paired with impersonation); rewrites "Token caching and rotation" to match the credential-registry behavior that replaced the old token-string cache (proactive background refresh, 1h idle eviction, shared across discovery and invocations — the 60-second early-eviction margin no longer exists).Review notes
<ENVIRONMENT_NAMESPACE>derivation (env_→env-) matches the control plane's namespace derivation; the companion Cloud UI change shows these commands prefilled per environment, and the section links there.connecting-serviceswas considered and deferred; the page is still navigable with the new section, and the split would churn every anchor.