mmv1/products/cloudrunv2/Job.yaml

# Copyright 2024 Google Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
name: 'Job'
description: |
  A Cloud Run Job resource that references a container image which is run to completion.
references:
  guides:
    'Official Documentation': 'https://cloud.google.com/run/docs/'
  api: 'https://cloud.google.com/run/docs/reference/rest/v2/projects.locations.jobs'
docs:
id_format: 'projects/{{project}}/locations/{{location}}/jobs/{{name}}'
base_url: 'projects/{{project}}/locations/{{location}}/jobs'
self_link: 'projects/{{project}}/locations/{{location}}/jobs/{{name}}'
create_url: 'projects/{{project}}/locations/{{location}}/jobs?jobId={{name}}'
update_verb: 'PATCH'
import_format:
  - 'projects/{{project}}/locations/{{location}}/jobs/{{name}}'
timeouts:
  insert_minutes: 20
  update_minutes: 20
  delete_minutes: 20
autogen_async: true
async:
  actions: ['create', 'delete', 'update']
  type: 'OpAsync'
  operation:
    base_url: '{{op_id}}'
  result:
    resource_inside_response: true
iam_policy:
  method_name_separator: ':'
  parent_resource_attribute: 'name'
  base_url: 'projects/{{project}}/locations/{{location}}/jobs/{{name}}'
  example_config_body: 'templates/terraform/iam/iam_attributes.go.tmpl'
  import_format:
    - 'projects/{{project}}/locations/{{location}}/jobs/{{name}}'
    - '{{name}}'
custom_code:
  pre_delete: 'templates/terraform/pre_delete/cloudrunv2_job_deletion_policy.go.tmpl'
taint_resource_on_failed_create: true
examples:
  - name: 'cloudrunv2_job_basic'
    primary_resource_id: 'default'
    primary_resource_name: 'fmt.Sprintf("tf-test-cloudrun-job%s", context["random_suffix"])'
    vars:
      cloud_run_job_name: 'cloudrun-job'
    ignore_read_extra:
      - 'deletion_protection'
  - name: 'cloudrunv2_job_limits'
    primary_resource_id: 'default'
    vars:
      cloud_run_job_name: 'cloudrun-job'
    ignore_read_extra:
      - 'deletion_protection'
  - name: 'cloudrunv2_job_sql'
    primary_resource_id: 'default'
    primary_resource_name: 'fmt.Sprintf("tf-test-cloudrun-srv%s", context["random_suffix"])'
    vars:
      cloud_run_job_name: 'cloudrun-job'
      secret_id: 'secret'
      cloud_run_sql_name: 'cloudrun-sql'
      deletion_protection: 'true'
    test_vars_overrides:
      'deletion_protection': 'false'
    oics_vars_overrides:
      'deletion_protection': 'false'
    ignore_read_extra:
      - 'deletion_protection'
  - name: 'cloudrunv2_job_vpcaccess'
    primary_resource_id: 'default'
    primary_resource_name: 'fmt.Sprintf("tf-test-cloudrun-srv%s", context["random_suffix"])'
    vars:
      cloud_run_job_name: 'cloudrun-job'
      vpc_access_connector_name: 'run-vpc'
      vpc_compute_subnetwork_name: 'run-subnetwork'
      compute_network_name: 'run-network'
    ignore_read_extra:
      - 'deletion_protection'
  - name: 'cloudrunv2_job_directvpc'
    primary_resource_id: 'default'
    primary_resource_name: 'fmt.Sprintf("tf-test-cloudrun-job%s", context["random_suffix"])'
    vars:
      cloud_run_job_name: 'cloudrun-job'
    ignore_read_extra:
      - 'deletion_protection'
  - name: 'cloudrunv2_job_secret'
    primary_resource_id: 'default'
    primary_resource_name: 'fmt.Sprintf("tf-test-cloudrun-srv%s", context["random_suffix"])'
    vars:
      cloud_run_job_name: 'cloudrun-job'
      secret_id: 'secret'
    ignore_read_extra:
      - 'deletion_protection'
  - name: 'cloudrunv2_job_emptydir'
    primary_resource_id: 'default'
    primary_resource_name: 'fmt.Sprintf("tf-test-cloudrun-job%s", context["random_suffix"])'
    vars:
      cloud_run_job_name: 'cloudrun-job'
    ignore_read_extra:
      - 'deletion_protection'
  - name: 'cloudrunv2_job_run_job'
    primary_resource_id: 'default'
    primary_resource_name: 'fmt.Sprintf("tf-test-cloudrun-job%s", context["random_suffix"])'
    min_version: 'beta'
    vars:
      cloud_run_job_name: 'cloudrun-job'
    ignore_read_extra:
      - 'deletion_protection'
  - name: 'cloudrunv2_job_multicontainer'
    primary_resource_id: 'default'
    primary_resource_name: 'fmt.Sprintf("tf-test-cloudrun-job%s", context["random_suffix"])'
    vars:
      cloud_run_job_name: 'cloudrun-job'
    ignore_read_extra:
      - 'deletion_protection'
virtual_fields:
  - name: 'deletion_protection'
    description: |
      Whether Terraform will be prevented from destroying the job. Defaults to true.
      When a`terraform destroy` or `terraform apply` would delete the job,
      the command will fail if this field is not set to false in Terraform state.
      When the field is set to true or unset in Terraform state, a `terraform apply`
      or `terraform destroy` that would delete the job will fail.
      When the field is set to false, deleting the job is allowed.
    type: Boolean
    default_value: true
parameters:
  - name: 'location'
    type: String
    description: The location of the cloud run job
    url_param_only: true
    required: true
    immutable: true
properties:
  - name: 'name'
    type: String
    description: |
      Name of the Job.
    url_param_only: true
    required: true
    immutable: true
    diff_suppress_func: 'tpgresource.CompareSelfLinkOrResourceName'
    custom_flatten: 'templates/terraform/custom_flatten/name_from_self_link.tmpl'
    custom_expand: 'templates/terraform/custom_expand/resource_from_self_link.go.tmpl'
  - name: 'uid'
    type: String
    description: |
      Server assigned unique identifier for the Execution. The value is a UUID4 string and guaranteed to remain unchanged until the resource is deleted.
    output: true
  - name: 'generation'
    type: String
    description: |
      A number that monotonically increases every time the user modifies the desired state.
    output: true
  - name: 'labels'
    type: KeyValueLabels
    description: |-
      Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,
      environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.

      Cloud Run API v2 does not support labels with `run.googleapis.com`, `cloud.googleapis.com`, `serving.knative.dev`, or `autoscaling.knative.dev` namespaces, and they will be rejected.
      All system labels in v1 now have a corresponding field in v2 Job.
  - name: 'annotations'
    type: KeyValueAnnotations
    description: |-
      Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.

      Cloud Run API v2 does not support annotations with `run.googleapis.com`, `cloud.googleapis.com`, `serving.knative.dev`, or `autoscaling.knative.dev` namespaces, and they will be rejected on new resources.
      All system annotations in v1 now have a corresponding field in v2 Job.

      This field follows Kubernetes annotations' namespacing, limits, and rules.
  - name: 'createTime'
    type: Time
    description: |-
      The creation time.
    output: true
  - name: 'updateTime'
    type: Time
    description: |-
      The last-modified time.
    output: true
  - name: 'deleteTime'
    type: Time
    description: |-
      The deletion time.
    output: true
  - name: 'expireTime'
    type: Time
    description: |-
      For a deleted resource, the time after which it will be permanently deleted.
    output: true
  - name: 'creator'
    type: String
    description: |-
      Email address of the authenticated creator.
    output: true
  - name: 'lastModifier'
    type: String
    description: |-
      Email address of the last authenticated modifier.
    output: true
  - name: 'client'
    type: String
    description: |
      Arbitrary identifier for the API client.
  - name: 'clientVersion'
    type: String
    description: |
      Arbitrary version identifier for the API client.
  - name: 'launchStage'
    type: Enum
    description: |
      The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.
      If no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.

      For example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output.
    default_from_api: true
    enum_values:
      - 'UNIMPLEMENTED'
      - 'PRELAUNCH'
      - 'EARLY_ACCESS'
      - 'ALPHA'
      - 'BETA'
      - 'GA'
      - 'DEPRECATED'
  - name: 'binaryAuthorization'
    type: NestedObject
    description: |
      Settings for the Binary Authorization feature.
    properties:
      - name: 'breakglassJustification'
        type: String
        description: |
          If present, indicates to use Breakglass using this justification. If useDefault is False, then it must be empty. For more information on breakglass, see https://cloud.google.com/binary-authorization/docs/using-breakglass
      - name: 'useDefault'
        type: Boolean
        description: |
          If True, indicates to use the default project's binary authorization policy. If False, binary authorization will be disabled.
        conflicts:
          - policy
      - name: 'policy'
        type: String
        description: |
          The path to a binary authorization policy. Format: projects/{project}/platforms/cloudRun/{policy-name}
        conflicts:
          - use_default
  - name: 'startExecutionToken'
    type: String
    description: |-
      A unique string used as a suffix creating a new execution upon job create or update. The Job will become ready when the execution is successfully started.
      The sum of job name and token length must be fewer than 63 characters.
    min_version: 'beta'
    conflicts:
      - run_execution_token
  - name: 'runExecutionToken'
    type: String
    description: |-
      A unique string used as a suffix creating a new execution upon job create or update. The Job will become ready when the execution is successfully completed.
      The sum of job name and token length must be fewer than 63 characters.
    min_version: 'beta'
    conflicts:
      - start_execution_token
  - name: 'template'
    type: NestedObject
    description: |
      The template used to create executions for this Job.
    required: true
    properties:
      - name: 'labels'
        type: KeyValuePairs
        description: |-
          Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter,
          or break down billing charges by team, component, environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or
          https://cloud.google.com/run/docs/configuring/labels.

          Cloud Run API v2 does not support labels with `run.googleapis.com`, `cloud.googleapis.com`, `serving.knative.dev`, or `autoscaling.knative.dev` namespaces, and they will be rejected.
          All system labels in v1 now have a corresponding field in v2 ExecutionTemplate.
      - name: 'annotations'
        type: KeyValuePairs
        description: |-
          Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.

          Cloud Run API v2 does not support annotations with `run.googleapis.com`, `cloud.googleapis.com`, `serving.knative.dev`, or `autoscaling.knative.dev` namespaces, and they will be rejected.
          All system annotations in v1 now have a corresponding field in v2 ExecutionTemplate.

          This field follows Kubernetes annotations' namespacing, limits, and rules.
      - name: 'parallelism'
        type: Integer
        description: |-
          Specifies the maximum desired number of tasks the execution should run at given time. Must be <= taskCount. When the job is run, if this field is 0 or unset, the maximum possible value will be used for that execution. The actual number of tasks running in steady state will be less than this number when there are fewer tasks waiting to be completed remaining, i.e. when the work left to do is less than max parallelism.
        default_from_api: true
      - name: 'taskCount'
        type: Integer
        description: |-
          Specifies the desired number of tasks the execution should run. Setting to 1 means that parallelism is limited to 1 and the success of that task signals the success of the execution. More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/
        default_from_api: true
      - name: 'template'
        type: NestedObject
        description: |
          Describes the task(s) that will be created when executing an execution
        required: true
        properties:
          - name: 'containers'
            type: Array
            description: |-
              Holds the single container that defines the unit of execution for this task.
            default_from_api: true
            item_type:
              type: NestedObject
              properties:
                - name: 'name'
                  type: String
                  description: |-
                    Name of the container specified as a DNS_LABEL.
                - name: 'image'
                  type: String
                  description: |-
                    URL of the Container image in Google Container Registry or Google Artifact Registry. More info: https://kubernetes.io/docs/concepts/containers/images
                  required: true
                - name: 'command'
                  type: Array
                  description: |-
                    Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
                  item_type:
                    type: String
                - name: 'args'
                  type: Array
                  description: |-
                    Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references are not supported in Cloud Run.
                  item_type:
                    type: String
                - name: 'env'
                  type: Array
                  description: |-
                    List of environment variables to set in the container.
                  is_set: true
                  item_type:
                    type: NestedObject
                    properties:
                      - name: 'name'
                        type: String
                        description: |-
                          Name of the environment variable. Must be a C_IDENTIFIER, and mnay not exceed 32768 characters.
                        required: true
                      - name: 'value'
                        type: String
                        # env is a set.
                        # The env.value has value "" in Terraform state, but it has value nil in Terraform plan,
                        # which causes the diffs for unchanged env. default_value: "" is to suppress the diffs.
                        default_value: ""
                        description: |-
                          Literal value of the environment variable. Defaults to "" and the maximum allowed length is 32768 characters. Variable references are not supported in Cloud Run.
                        # exactly_one_of:
                        #   - template.0.template.0.containers.0.env.0.value
                        #   - template.0.template.0.containers.0.env.0.valueSource
                      - name: 'valueSource'
                        type: NestedObject
                        description: |-
                          Source for the environment variable's value.
                        # exactly_one_of:
                        #   - template.0.template.0.containers.0.env.0.value
                        #   - template.0.template.0.containers.0.env.0.valueSource
                        properties:
                          - name: 'secretKeyRef'
                            type: NestedObject
                            description: |-
                              Selects a secret and a specific version from Cloud Secret Manager.
                            properties:
                              - name: 'secret'
                                type: String
                                description: |-
                                  The name of the secret in Cloud Secret Manager. Format: {secretName} if the secret is in the same project. projects/{project}/secrets/{secretName} if the secret is in a different project.
                                required: true
                              - name: 'version'
                                type: String
                                description: |-
                                  The Cloud Secret Manager secret version. Can be 'latest' for the latest value or an integer for a specific version.
                                required: true
                - name: 'resources'
                  type: NestedObject
                  description: |-
                    Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
                  default_from_api: true
                  properties:
                    - name: 'limits'
                      type: KeyValuePairs
                      description: |-
                        Only memory and CPU are supported. Use key `cpu` for CPU limit and `memory` for memory limit. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
                      default_from_api: true
                - name: 'ports'
                  type: Array
                  description: |-
                    List of ports to expose from the container. Only a single port can be specified. The specified ports must be listening on all interfaces (0.0.0.0) within the container to be accessible.

                    If omitted, a port number will be chosen and passed to the container through the PORT environment variable for the container to listen on
                  item_type:
                    type: NestedObject
                    properties:
                      - name: 'name'
                        type: String
                        description: |-
                          If specified, used to specify which protocol to use. Allowed values are "http1" and "h2c".
                      - name: 'containerPort'
                        type: Integer
                        description: |-
                          Port number the container listens on. This must be a valid TCP port number, 0 < containerPort < 65536.
                - name: 'volumeMounts'
                  type: Array
                  description: |-
                    Volume to mount into the container's filesystem.
                  item_type:
                    type: NestedObject
                    properties:
                      - name: 'name'
                        type: String
                        description: |-
                          This must match the Name of a Volume.
                        required: true
                      - name: 'mountPath'
                        type: String
                        description: |-
                          Path within the container at which the volume should be mounted. Must not contain ':'. For Cloud SQL volumes, it can be left empty, or must otherwise be /cloudsql. All instances defined in the Volume will be available as /cloudsql/[instance]. For more information on Cloud SQL volumes, visit https://cloud.google.com/sql/docs/mysql/connect-run
                        required: true
                - name: 'workingDir'
                  type: String
                  description: |-
                    Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image.
          - name: 'volumes'
            type: Array
            description: |-
              A list of Volumes to make available to containers.
            item_type:
              type: NestedObject
              properties:
                - name: 'name'
                  type: String
                  description: |-
                    Volume's name.
                  required: true
                - name: 'secret'
                  type: NestedObject
                  description: |-
                    Secret represents a secret that should populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
                  # exactly_one_of:
                  #   - template.0.template.0.volumes.0.secret
                  #   - template.0.template.0.volumes.0.cloudSqlInstance
                  #   - template.0.template.0.volumes.0.emptyDir
                  #   - template.0.volumes.0.gcs
                  #   - template.0.volumes.0.nfs
                  properties:
                    - name: 'secret'
                      type: String
                      description: |-
                        The name of the secret in Cloud Secret Manager. Format: {secret} if the secret is in the same project. projects/{project}/secrets/{secret} if the secret is in a different project.
                      required: true
                    - name: 'defaultMode'
                      type: Integer
                      description: |-
                        Integer representation of mode bits to use on created files by default. Must be a value between 0000 and 0777 (octal), defaulting to 0444. Directories within the path are not affected by this setting.
                    - name: 'items'
                      type: Array
                      description: |-
                        If unspecified, the volume will expose a file whose name is the secret, relative to VolumeMount.mount_path. If specified, the key will be used as the version to fetch from Cloud Secret Manager and the path will be the name of the file exposed in the volume. When items are defined, they must specify a path and a version.
                      item_type:
                        type: NestedObject
                        properties:
                          - name: 'path'
                            type: String
                            description: |-
                              The relative path of the secret in the container.
                            required: true
                          - name: 'version'
                            type: String
                            description: |-
                              The Cloud Secret Manager secret version. Can be 'latest' for the latest value or an integer for a specific version
                            required: true
                          - name: 'mode'
                            type: Integer
                            description: |-
                              Integer octal mode bits to use on this file, must be a value between 01 and 0777 (octal). If 0 or not set, the Volume's default mode will be used.
                - name: 'cloudSqlInstance'
                  type: NestedObject
                  description: |-
                    For Cloud SQL volumes, contains the specific instances that should be mounted. Visit https://cloud.google.com/sql/docs/mysql/connect-run for more information on how to connect Cloud SQL and Cloud Run.
                  # exactly_one_of:
                  #   - template.0.template.0.volumes.0.secret
                  #   - template.0.template.0.volumes.0.cloudSqlInstance
                  #   - template.0.template.0.volumes.0.emptyDir
                  #   - template.0.volumes.0.gcs
                  #   - template.0.volumes.0.nfs
                  properties:
                    - name: 'instances'
                      type: Array
                      description: |-
                        The Cloud SQL instance connection names, as can be found in https://console.cloud.google.com/sql/instances. Visit https://cloud.google.com/sql/docs/mysql/connect-run for more information on how to connect Cloud SQL and Cloud Run. Format: {project}:{location}:{instance}
                      item_type:
                        type: String
                - name: 'emptyDir'
                  type: NestedObject
                  description: |-
                    Ephemeral storage used as a shared volume.
                  # exactly_one_of:
                  #   - template.0.template.0.volumes.0.secret
                  #   - template.0.template.0.volumes.0.cloudSqlInstance
                  #   - template.0.template.0.volumes.0.emptyDir
                  #   - template.0.volumes.0.gcs
                  #   - template.0.volumes.0.nfs
                  properties:
                    - name: 'medium'
                      type: Enum
                      description: |-
                        The different types of medium supported for EmptyDir.
                      default_value: "MEMORY"
                      enum_values:
                        - 'MEMORY'
                    - name: 'sizeLimit'
                      type: String
                      description: |-
                          Limit on the storage usable by this EmptyDir volume. The size limit is also applicable for memory medium. The maximum usage on memory medium EmptyDir would be the minimum value between the SizeLimit specified here and the sum of memory limits of all containers in a pod. This field's values are of the 'Quantity' k8s type: https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/. The default is nil which means that the limit is undefined. More info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir.
                - name: 'gcs'
                  type: NestedObject
                  description: |-
                    Cloud Storage bucket mounted as a volume using GCSFuse.
                  # exactly_one_of:
                  #   - template.0.volumes.0.secret
                  #   - template.0.volumes.0.cloudSqlInstance
                  #   - template.0.volumes.0.emptyDir
                  #   - template.0.volumes.0.gcs
                  #   - template.0.volumes.0.nfs
                  properties:
                    - name: 'bucket'
                      type: String
                      description: |-
                        Name of the cloud storage bucket to back the volume. The resource service account must have permission to access the bucket.
                      required: true
                    - name: 'readOnly'
                      type: Boolean
                      description: |-
                        If true, mount this volume as read-only in all mounts. If false, mount this volume as read-write.
                    - name: 'mountOptions'
                      type: Array
                      min_version: 'beta'
                      description: |
                        A list of flags to pass to the gcsfuse command for configuring this volume.
                        Flags should be passed without leading dashes.
                      item_type:
                        type: String
                - name: 'nfs'
                  type: NestedObject
                  description: |-
                    NFS share mounted as a volume.
                  # exactly_one_of:
                  #   - template.0.volumes.0.secret
                  #   - template.0.volumes.0.cloudSqlInstance
                  #   - template.0.volumes.0.emptyDir
                  #   - template.0.volumes.0.gcs
                  #   - template.0.volumes.0.nfs
                  properties:
                    - name: 'server'
                      type: String
                      description: |-
                        Hostname or IP address of the NFS server.
                      required: true
                    - name: 'path'
                      type: String
                      description: |-
                        Path that is exported by the NFS server.
                    - name: 'readOnly'
                      type: Boolean
                      description: |-
                        If true, mount this volume as read-only in all mounts.
          - name: 'timeout'
            type: String
            description: |-
              Max allowed time duration the Task may be active before the system will actively try to mark it failed and kill associated containers. This applies per attempt of a task, meaning each retry can run for the full timeout.

              A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
            default_from_api: true
            validation:
              regex: '^[0-9]+(?:\.[0-9]{1,9})?s$'
          - name: 'serviceAccount'
            type: String
            description: |-
              Email address of the IAM service account associated with the Task of a Job. The service account represents the identity of the running task, and determines what permissions the task has. If not provided, the task will use the project's default service account.
            default_from_api: true
          - name: 'executionEnvironment'
            type: Enum
            description: |-
              The execution environment being used to host this Task.
            default_from_api: true
            enum_values:
              - 'EXECUTION_ENVIRONMENT_GEN1'
              - 'EXECUTION_ENVIRONMENT_GEN2'
          - name: 'encryptionKey'
            type: String
            description: |-
              A reference to a customer managed encryption key (CMEK) to use to encrypt this container image. For more information, go to https://cloud.google.com/run/docs/securing/using-cmek
          - name: 'vpcAccess'
            type: NestedObject
            description: |-
              VPC Access configuration to use for this Task. For more information, visit https://cloud.google.com/run/docs/configuring/connecting-vpc.
            properties:
              - name: 'connector'
                type: String
                description: |-
                  VPC Access connector name. Format: projects/{project}/locations/{location}/connectors/{connector}, where {project} can be project id or number.
              - name: 'egress'
                type: Enum
                description: |-
                  Traffic VPC egress settings.
                default_from_api: true
                enum_values:
                  - 'ALL_TRAFFIC'
                  - 'PRIVATE_RANGES_ONLY'
              - name: 'networkInterfaces'
                type: Array
                description: |-
                  Direct VPC egress settings. Currently only single network interface is supported.
                item_type:
                  type: NestedObject
                  properties:
                    - name: 'network'
                      type: String
                      description: |-
                        The VPC network that the Cloud Run resource will be able to send traffic to. At least one of network or subnetwork must be specified. If both
                        network and subnetwork are specified, the given VPC subnetwork must belong to the given VPC network. If network is not specified, it will be
                        looked up from the subnetwork.
                      default_from_api: true
                    - name: 'subnetwork'
                      type: String
                      description: |-
                        The VPC subnetwork that the Cloud Run resource will get IPs from. At least one of network or subnetwork must be specified. If both
                        network and subnetwork are specified, the given VPC subnetwork must belong to the given VPC network. If subnetwork is not specified, the
                        subnetwork with the same name with the network will be used.
                      default_from_api: true
                    - name: 'tags'
                      type: Array
                      description: |-
                        Network tags applied to this Cloud Run job.
                      item_type:
                        type: String
          - name: 'maxRetries'
            type: Integer
            description: |-
              Number of retries allowed per Task, before marking this Task failed. Defaults to 3. Minimum value is 0.
            send_empty_value: true
            default_value: 3
  - name: 'observedGeneration'
    type: String
    description: |
      The generation of this Job. See comments in reconciling for additional information on reconciliation process in Cloud Run.
    output: true
  - name: 'terminalCondition'
    type: NestedObject
    description: |
      The Condition of this Job, containing its readiness status, and detailed error information in case it did not reach the desired state
    output: true
    properties:
      - name: 'type'
        type: String
        description: |-
          type is used to communicate the status of the reconciliation process. See also: https://github.com/knative/serving/blob/main/docs/spec/errors.md#error-conditions-and-reporting Types common to all resources include: * "Ready": True when the Resource is ready.
        output: true
      - name: 'state'
        type: String
        description: |-
          State of the condition.
        output: true
      - name: 'message'
        type: String
        description: |-
          Human readable message indicating details about the current status.
        output: true
      - name: 'lastTransitionTime'
        type: Time
        description: |-
          Last time the condition transitioned from one status to another.

          A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
        output: true
      - name: 'severity'
        type: String
        description: |-
          How to interpret failures of this condition, one of Error, Warning, Info
        output: true
      - name: 'reason'
        type: String
        description: |-
          A common (service-level) reason for this condition.
        output: true
      - name: 'revisionReason'
        type: String
        description: |-
          A reason for the revision condition.
        output: true
      - name: 'executionReason'
        type: String
        description: |-
          A reason for the execution condition.
        output: true
  - name: 'conditions'
    type: Array
    description: |-
      The Conditions of all other associated sub-resources. They contain additional diagnostics information in case the Job does not reach its desired state. See comments in reconciling for additional information on `reconciliation` process in Cloud Run.
    output: true
    item_type:
      type: NestedObject
      properties:
        - name: 'type'
          type: String
          description: |-
            type is used to communicate the status of the reconciliation process. See also: https://github.com/knative/serving/blob/main/docs/spec/errors.md#error-conditions-and-reporting Types common to all resources include: * "Ready": True when the Resource is ready.
          output: true
        - name: 'state'
          type: String
          description: |-
            State of the condition.
          output: true
        - name: 'message'
          type: String
          description: |-
            Human readable message indicating details about the current status.
          output: true
        - name: 'lastTransitionTime'
          type: Time
          description: |-
            Last time the condition transitioned from one status to another.

            A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
          output: true
        - name: 'severity'
          type: String
          description: |-
            How to interpret failures of this condition, one of Error, Warning, Info
          output: true
        - name: 'reason'
          type: String
          description: |-
            A common (service-level) reason for this condition.
          output: true
        - name: 'revisionReason'
          type: String
          description: |-
            A reason for the revision condition.
          output: true
        - name: 'executionReason'
          type: String
          description: |-
            A reason for the execution condition.
          output: true
  - name: 'executionCount'
    type: Integer
    description: |
      Number of executions created for this job.
    output: true
  - name: 'latestCreatedExecution'
    type: NestedObject
    description: |
      Name of the last created execution.
    output: true
    properties:
      - name: 'name'
        type: String
        description: |
          Name of the execution.
        output: true
      - name: 'createTime'
        type: Time
        description: |
          Creation timestamp of the execution.

          A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
        output: true
      - name: 'completionTime'
        type: Time
        description: |
          Completion timestamp of the execution.

          A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
        output: true
  - name: 'reconciling'
    type: Boolean
    description: |
      Returns true if the Job is currently being acted upon by the system to bring it into the desired state.

      When a new Job is created, or an existing one is updated, Cloud Run will asynchronously perform all necessary steps to bring the Job to the desired state. This process is called reconciliation. While reconciliation is in process, observedGeneration and latest_succeeded_execution, will have transient values that might mismatch the intended state: Once reconciliation is over (and this field is false), there are two possible outcomes: reconciliation succeeded and the state matches the Job, or there was an error, and reconciliation failed. This state can be found in terminalCondition.state.

      If reconciliation succeeded, the following fields will match: observedGeneration and generation, latest_succeeded_execution and latestCreatedExecution.

      If reconciliation failed, observedGeneration and latest_succeeded_execution will have the state of the last succeeded execution or empty for newly created Job. Additional information on the failure can be found in terminalCondition and conditions
    output: true
  - name: 'etag'
    type: String
    description: |
      A system-generated fingerprint for this version of the resource. May be used to detect modification conflict during updates.
    output: true