Create a trigger for Google Kubernetes Engine (GKE)

Preview — Eventarc for GKE and Cloud Run for Anthos; Cloud IoT; Firebase Alerts, Firebase Realtime Database, Firebase Remote Config, and Firebase Test Lab events

This feature is covered by the Pre-GA Offerings Terms of the Google Cloud Terms of Service. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the launch stage descriptions.

An Eventarc trigger declares your interest in a certain event or set of events. You can configure event routing by specifying filters for the trigger, including the event source and the target Google Kubernetes Engine service or Cloud Run for Anthos service running in a GKE cluster.

Note: You can use these instructions to configure event routing to private and public Cloud Run for Anthos services running in a GKE cluster.

Requests to your service are triggered by the following event types:

• When an audit log is created that matches the trigger's filter criteria
• In response to direct events such as an update to a Cloud Storage bucket or an update to a Firebase Remote Config template
• By messages published to a Pub/Sub topic

Before you begin

You must enable Workload Identity on the GKE cluster that the destination service is running on. Workload Identity is required to properly set up the event forwarder and is the recommended way to access Google Cloud services from applications running within GKE due to its improved security properties and manageability.

Workload Identity

Applications running on GKE might need access to Google Cloud APIs. Workload Identity allows a Kubernetes service account in your GKE cluster to act as an IAM service account. Pods that use the configured Kubernetes service account automatically authenticate as the IAM service account when accessing Google Cloud APIs. Using Workload Identity allows you to assign distinct, fine-grained identities and authorization for each application in your cluster. Note that specific permissions must be granted to the Eventarc trigger's service account. In this document, see Create a service account.

Workload Identity is also needed to forward Cloud Run for Anthos events using Eventarc. For more information on enabling and configuring Workload Identity on your GKE clusters, refer to Use Workload Identity.

Event forwarder

Eventarc's event forwarder pulls new events from Eventarc and forwards them to the GKE destination. This component acts as a mediator between the Pub/Sub transport layer and the GKE service. It works on existing services and also supports signaling services (including those not exposed outside of the fully-managed cluster) while simplifying setup and maintenance. At a networking level, to receive events in a GKE service, you don't need to open the service to external traffic as all events are delivered from an origin that resides within the same GKE cluster.

Note that the event forwarder's lifecycle is managed by Eventarc, and if you accidentally delete the event forwarder, Eventarc will restore this component.

For each trigger pointing to a GKE destination, the event forwarder (a specifically configured gke-forwarder pod) does the following:

1. It uses the Pub/Sub API to open a StreamingPull connection to the trigger transporter (a Pub/Sub topic and subscription) and receives events as they become available.

2. It transforms events to the correct CloudEvents format and encodes and delivers them as an HTTP POST request to the target GKE service.

The Eventarc service agent needs the permission to run and regularly update the gke-forwarder instance. This permission must be granted once-per-project. For details, in this document, see Enable GKE destinations.

Prepare to create a trigger

For each trigger that targets a GKE service, Eventarc creates an event forwarder component. Eventarc requires permissions to install the component and manage resources in the GKE cluster. Before creating an Eventarc trigger for GKE destinations, ensure that you complete the following tasks.

Enable the Eventarc API

To view and assign Identity and Access Management (IAM) roles, you must enable the Eventarc API for your project. You will not be able to see the Eventarc roles in the Google Cloud console until you enable the API.

gcloud services enable eventarc.googleapis.com

Grant the required user role

Grant the Eventarc Admin role (roles/eventarc.admin) to the user:

gcloud projects add-iam-policy-binding PROJECT_ID \
    --member=PRINCIPAL \
    --role="roles/eventarc.admin"

Replace the following values:

• PROJECT_ID: the Google Cloud project ID.
• PRINCIPAL: the principal to add the binding for. Should be of the form user|group|serviceAccount:email or domain:domain.

  Examples: user:[e-mail], group:[e-mail], serviceAccount:[e-mail], or domain:example.domain.com

Create a service account

Create a user-managed service account if you don't already have one, then grant it the roles and permissions necessary so that Eventarc can manage events for GKE destinations.

1. Create a service account that is used when creating triggers:

   TRIGGER_SA=SA_NAME
   gcloud iam service-accounts create ${TRIGGER_SA}

   Replace SA_NAME with the name of the service account. It must be between 6 and 30 characters, and can contain lowercase alphanumeric characters and dashes. After you create a service account, you cannot change its name.

2. Grant the appropriate roles to the service account:

   Cloud Audit Logs events

   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member "serviceAccount:${TRIGGER_SA}@PROJECT_ID.iam.gserviceaccount.com" \
       --role="roles/pubsub.subscriber"
   
   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member "serviceAccount:${TRIGGER_SA}@PROJECT_ID.iam.gserviceaccount.com" \
       --role="roles/monitoring.metricWriter"
   
   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member "serviceAccount:${TRIGGER_SA}@PROJECT_ID.iam.gserviceaccount.com" \
       --role="roles/eventarc.eventReceiver"
   

   Direct events

   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member "serviceAccount:${TRIGGER_SA}@PROJECT_ID.iam.gserviceaccount.com" \
       --role="roles/pubsub.subscriber"
   
   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member "serviceAccount:${TRIGGER_SA}@PROJECT_ID.iam.gserviceaccount.com" \
       --role="roles/monitoring.metricWriter"
   
   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member "serviceAccount:${TRIGGER_SA}@PROJECT_ID.iam.gserviceaccount.com" \
       --role="roles/eventarc.eventReceiver"
   

   Pub/Sub messages

   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member "serviceAccount:${TRIGGER_SA}@PROJECT_ID.iam.gserviceaccount.com" \
       --role="roles/pubsub.subscriber"
   
   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member "serviceAccount:${TRIGGER_SA}@PROJECT_ID.iam.gserviceaccount.com" \
       --role="roles/monitoring.metricWriter"
   
   

   Replace PROJECT_ID with your Google Cloud project ID. You can find your project ID on the Dashboard page of the Google Cloud console.

3. If you are creating a trigger for a direct Cloud Storage event, grant the pubsub.publisher role to the Cloud Storage service account:

   SERVICE_ACCOUNT="$(gsutil kms serviceaccount -p PROJECT_ID)"
   
   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member="serviceAccount:${SERVICE_ACCOUNT}" \
       --role="roles/pubsub.publisher"
   

Enable GKE destinations

To allow Eventarc to manage resources in the GKE cluster, enable GKE destinations, and bind the Eventarc service account with the required roles.

1. Enable GKE destinations for Eventarc:

   gcloud eventarc gke-destinations init
   

2. At the prompt to bind the required roles, enter y.

   The following roles are bound:

   • roles/compute.viewer
   • roles/container.developer
   • roles/iam.serviceAccountAdmin

Create a trigger using the Google Cloud CLI

You can create a trigger by running a gcloud eventarc triggers create command along with required and optional flags.

Note: Filtering is done through an exact match and does not support wildcards or regular expressions. However, for Cloud Audit Logs, Firebase Realtime Database, and Cloud IoT triggers, you can use the --event-filters-path-pattern flag and define a path pattern.

Cloud Audit Logs events

gcloud eventarc triggers create TRIGGER \
    --location=LOCATION \
    --destination-gke-cluster=DESTINATION_GKE_CLUSTER \
    --destination-gke-location=DESTINATION_GKE_LOCATION \
    --destination-gke-namespace=DESTINATION_GKE_NAMESPACE \
    --destination-gke-service=DESTINATION_GKE_SERVICE \
    --destination-gke-path=DESTINATION_GKE_PATH \
    --event-filters="type=google.cloud.audit.log.v1.written" \
    --event-filters="serviceName=SERVICE_NAME" \
    --event-filters="methodName=METHOD_NAME" \
    --service-account=TRIGGER_SERVICE_ACCOUNT@PROJECT_ID.iam.gserviceaccount.com

Replace the following:

• TRIGGER: the ID of the trigger or a fully qualified identifier.
• LOCATION: the location of the Eventarc trigger. To avoid any performance and data residency issues caused by a global trigger, it should match the location of the Google Cloud service that is generating events. Alternatively, you can set the eventarc/location property; for example gcloud config set eventarc/location us-central1. For more information, see Eventarc locations.
• DESTINATION_GKE_CLUSTER: the name of the GKE cluster in which the target GKE service that receives events is running.
• DESTINATION_GKE_LOCATION: the location in which the destination GKE service can be found. If not specified, it is assumed that the service is in the same region as the trigger. For more information see Cloud Run for Anthos on Google Cloud locations.
• DESTINATION_GKE_NAMESPACE: the namespace in which the destination GKE service is running. If not specified, the default namespace is used.
• DESTINATION_GKE_SERVICE: the name of the GKE service that receives the events for the trigger. The service can be in any of the GKE supported locations and does not need to be in the same location as the trigger. However, the service must be in the same project as the trigger and will receive events as HTTP POST requests sent to its root URL path (/), whenever the event is generated.
• (Optional) DESTINATION_GKE_PATH: the relative path you specify on the destination GKE service to which the events for the trigger should be sent. For example: /, /route, route, route/subroute.
• SERVICE_NAME: the identifier of the Google Cloud service
• METHOD_NAME: the identifier of the operation
• TRIGGER_SERVICE_ACCOUNT: the IAM service account email associated with the trigger and to which you previously granted specific roles required by Eventarc. For example, $TRIGGER_SA@PROJECT_ID.iam.gserviceaccount.com
• PROJECT_ID: your Google Cloud project ID

Notes:

• These flags are required:
  • --event-filters="type=google.cloud.audit.log.v1.written"
  • --event-filters="serviceName=VALUE"
  • --event-filters="methodName=VALUE"
• After a trigger is created, --event-filters="type=google.cloud.audit.log.v1.written" can't be changed. For a different event type, you must create a new trigger.
• For a list of the audit log events supported by Eventarc, including serviceName and methodName values, see Events supported by Eventarc.
• Each trigger can have multiple event filters, comma delimited in one --event-filters=[ATTRIBUTE=VALUE,...] flag, or you can repeat the flag to add more filters. Only events that match all the filters are sent to the destination. Wildcards and regular expressions are not supported. See Determining event filters for Cloud Audit Logs.
• Optionally, you can filter events for a specific resource by using the --event-filters="resourceName=VALUE" flag and specifying the complete path to the resource. Omit the flag for dynamically created resources that have identifiers generated at creation time. Or, you can filter events for a set of resources by using the --event-filters-path-pattern="resourceName=VALUE" flag and specifying the resource path pattern.

Example:

  gcloud eventarc triggers create cal-gke-trigger \
      --location=us-central1 \
      --destination-gke-cluster=gke-events-cluster \
      --destination-gke-location=us-central1-a \
      --destination-gke-namespace=default \
      --destination-gke-service=helloworld-events \
      --destination-gke-path=/ \
      --event-filters="type=google.cloud.audit.log.v1.written" \
      --event-filters="serviceName=storage.googleapis.com" \
      --event-filters="methodName=storage.buckets.update" \
      --event-filters="resourceName=projects/_/buckets/eventarc-bucket/objects/random.txt" \
      --service-account=${TRIGGER_SA}@${PROJECT_ID}.iam.gserviceaccount.com

This creates a trigger called cal-gke-trigger for audit logs that are written by storage.googleapis.com and for the operation identified as storage.buckets.update.

Direct events

Cloud Storage

gcloud eventarc triggers create TRIGGER \
  --location=LOCATION \
  --destination-gke-cluster=DESTINATION_GKE_CLUSTER \
  --destination-gke-location=DESTINATION_GKE_LOCATION \
  --destination-gke-namespace=DESTINATION_GKE_NAMESPACE \
  --destination-gke-service=DESTINATION_GKE_SERVICE \
  --destination-gke-path=DESTINATION_GKE_PATH \
  --event-filters="type=EVENT_FILTER_TYPE" \
  --event-filters="bucket=BUCKET" \
  --service-account=TRIGGER_SERVICE_ACCOUNT@PROJECT_ID.iam.gserviceaccount.com

Replace the following:

• TRIGGER: the ID of the trigger or a fully qualified identifier.
• LOCATION: the location of the Eventarc trigger. The Cloud Storage bucket must reside in the same Google Cloud project and region or multi-region as the Eventarc trigger. Alternatively, you can set the eventarc/location property; for example gcloud config set eventarc/location us-central1. For more information, see Eventarc locations.
• DESTINATION_GKE_CLUSTER: the name of the GKE cluster in which the target GKE service that receives events is running.
• DESTINATION_GKE_LOCATION: the location in which the destination GKE service can be found. If not specified, it is assumed that the service is in the same region as the trigger. For more information see Cloud Run for Anthos on Google Cloud locations.
• DESTINATION_GKE_NAMESPACE: the namespace in which the destination GKE service is running. If not specified, the default namespace is used.
• DESTINATION_GKE_SERVICE: the name of the GKE service that receives the events for the trigger. The service can be in any of the GKE supported locations and does not need to be in the same location as the trigger. However, the service must be in the same project as the trigger and will receive events as HTTP POST requests sent to its root URL path (/), whenever the event is generated.
• (Optional) DESTINATION_GKE_PATH: the relative path you specify on the destination GKE service to which the events for the trigger should be sent. For example: /, /route, route, route/subroute.
• EVENT_FILTER_TYPE: the identifier of the Cloud Storage event and can be one of the following:
  • google.cloud.storage.object.v1.finalized: Event is sent when a new object is created (or an existing object is overwritten, and a new generation of that object is created) in the bucket
  • google.cloud.storage.object.v1.archived: Event is sent when a live version of an object is archived or deleted. This event is only sent for versioning buckets.
  • google.cloud.storage.object.v1.deleted: Event is sent when an object is permanently deleted. Depending on the object versioning setting for a bucket this means:
    • For versioning buckets, this is only sent when a version is permanently deleted (but not when an object is archived).
    • For non-versioning buckets, this is sent when an object is deleted or overwritten.
  • google.cloud.storage.object.v1.metadataUpdated: Event is sent when the metadata of an existing object changes.
• BUCKET is the globally unique identifier of the Cloud Storage bucket.
• TRIGGER_SERVICE_ACCOUNT: the IAM service account email associated with the trigger and to which you previously granted specific roles required by Eventarc. For example, $TRIGGER_SA@PROJECT_ID.iam.gserviceaccount.com
• PROJECT_ID: your Google Cloud project ID

Notes:

• These flags are required:
  • --event-filters="type=EVENT_FILTER_TYPE"
  • --event-filters="bucket=BUCKET"
• After a trigger is created, EVENT_FILTER_TYPE can't be changed. For a different event type, you must create a new trigger.
• Events are delivered using Pub/Sub notifications from Cloud Storage. Setting up too many notifications registered against the same bucket might exhaust the notification limit for the bucket as indicated by the error Cloud Storage bucket ...: Pub/Sub notification limit reached. The bucket can have up to 10 notification configurations set to trigger for a specific event. See more quotas and limitations in the Cloud Storage quotas and limits page.
• Each trigger can have multiple event filters, comma delimited in one --event-filters=[ATTRIBUTE=VALUE,...] flag, or you can repeat the flag to add more filters. Only events that match all the filters are sent to the destination. Wildcards and regular expressions are not supported.
• The --service-account flag is used to specify the Identity and Access Management (IAM) service account email associated with the trigger.
• (Optional) DESTINATION_GKE_PATH: the relative path you specify on the destination GKE service to which the events for the trigger should be sent. For example: /, /route, route, route/subroute.

Example:

gcloud eventarc triggers create storage-gke-trigger \
    --location=us-central1 \
    --destination-gke-cluster=gke-events-cluster \
    --destination-gke-location=us-central1-a \
    --destination-gke-namespace=default \
    --destination-gke-service=helloworld-events \
    --destination-gke-path=/ \
    --event-filters="type=google.cloud.storage.object.v1.finalized" \
    --event-filters="bucket=my-project-bucket" \
    --service-account=${TRIGGER_SA}@${PROJECT_ID}.iam.gserviceaccount.com

This command creates a trigger called storage-gke-trigger for the Cloud Storage bucket my-project-bucket and the event identified as google.cloud.storage.object.v1.finalized.

Firebase Alerts

gcloud eventarc triggers create TRIGGER \
  --location=global \
  --destination-gke-cluster=DESTINATION_GKE_CLUSTER \
  --destination-gke-location=DESTINATION_GKE_LOCATION \
  --destination-gke-namespace=DESTINATION_GKE_NAMESPACE \
  --destination-gke-service=DESTINATION_GKE_SERVICE \
  --destination-gke-path=DESTINATION_GKE_PATH \
  --event-filters="type=google.firebase.firebasealerts.alerts.v1.published" \
  --event-filters="alerttype=ALERT_TYPE" \
  --service-account=TRIGGER_SERVICE_ACCOUNT@PROJECT_ID.iam.gserviceaccount.com

Replace the following:

• TRIGGER: the ID of the trigger or a fully qualified identifier.
• DESTINATION_GKE_CLUSTER: the name of the GKE cluster in which the target GKE service that receives events is running.
• DESTINATION_GKE_LOCATION: the location in which the destination GKE service can be found. If not specified, it is assumed that the service is in the same region as the trigger. For more information see Cloud Run for Anthos on Google Cloud locations.
• DESTINATION_GKE_NAMESPACE: the namespace in which the destination GKE service is running. If not specified, the default namespace is used.
• DESTINATION_GKE_SERVICE: the name of the GKE service that receives the events for the trigger. The service can be in any of the GKE supported locations and does not need to be in the same location as the trigger. However, the service must be in the same project as the trigger and will receive events as HTTP POST requests sent to its root URL path (/), whenever the event is generated.
• (Optional) DESTINATION_GKE_PATH: the relative path you specify on the destination GKE service to which the events for the trigger should be sent. For example: /, /route, route, route/subroute.

• ALERT_TYPE: the type of Firebase alert and can be one of the following values:

  • appDistribution.inAppFeedback: event is sent when a tester submits in-app feedback for a given app
  • appDistribution.newTesterIosDevice: event is sent when a new iOS tester device is registered for a given app
  • billing.planAutomatedUpdate: event is sent when the billing plan for a Firebase project is automatically updated; for example, when a plan is downgraded due to payment issues
  • billing.planUpdate: event is sent when the billing plan for a Firebase project is modified by a user; for example, when a billing account is attached to or detached from a project
  • crashlytics.newAnrIssue: event is sent when an app experiences a new application not responding (ANR) error (not for any subsequent, identical events)
  • crashlytics.newFatalIssue: event is sent when an app experiences a new fatal crash (not for any subsequent, identical events)
  • crashlytics.newNonfatalIssue: event is sent when an app experiences a new non-fatal error (not for any subsequent, identical events)
  • crashlytics.regression: event is sent when an app experiences a crash for an issue marked as closed for a previous app version
  • crashlytics.stabilityDigest: event is sent when there is a notification of the top trending issues in Crashlytics
  • crashlytics.velocity: event is sent when a single issue is responsible for causing a significant number of app sessions to crash
  • performance.threshold: event is sent when the performance of a metric crosses the set threshold
  The operator for ALERT_TYPE must be one of the following:
  • Equal; for example, --event-filters="alerttype=appDistribution.inAppFeedback"
  • Path pattern; for example, --event-filters-path-pattern="alerttype=appDistribution.*" or --event-filters-path-pattern="alerttype=crashlytics.new*".

    For more information, see Understand path patterns.

• TRIGGER_SERVICE_ACCOUNT: the IAM service account email associated with the trigger and to which you previously granted specific roles required by Eventarc. For example, $TRIGGER_SA@PROJECT_ID.iam.gserviceaccount.com

• PROJECT_ID: your Google Cloud project ID

Notes:

• The --location flag must be global. For more information, see Eventarc locations.
• These flags are required:
  • --event-filters="type=google.firebase.firebasealerts.alerts.v1.published"
  • --event-filters="alerttype=ALERT_TYPE" or --event-filters-path-pattern="alerttype=ALERT_TYPE"
• After a trigger is created, the event filter type can't be changed. For a different event type, you must create a new trigger.
• Optionally, you can filter events for a specific Firebase App ID by using the --event-filters="appid=APP_ID" flag and by specifying an exact match.
• The --service-account flag is used to specify the Identity and Access Management (IAM) service account email associated with the trigger.

Example:

gcloud eventarc triggers create firealert-gke-trigger \
    --location=us-central1 \
    --destination-gke-cluster=gke-events-cluster \
    --destination-gke-location=us-central1-a \
    --destination-gke-namespace=default \
    --destination-gke-service=helloworld-events \
    --destination-gke-path=/ \
    --event-filters="type=google.firebase.firebasealerts.alerts.v1.published" \
    --event-filters="alerttype=crashlytics.velocity" \
    --service-account="${TRIGGER_SA}@${PROJECT_ID}.iam.gserviceaccount.com"

This command creates a trigger called firealert-gke-trigger for the event identified as google.firebase.firebasealerts.alerts.v1.published, and for a crashlytics.velocity alert type.

Firebase Realtime Database

gcloud eventarc triggers create TRIGGER \
  --location=LOCATION \
  --destination-gke-cluster=DESTINATION_GKE_CLUSTER \
  --destination-gke-location=DESTINATION_GKE_LOCATION \
  --destination-gke-namespace=DESTINATION_GKE_NAMESPACE \
  --destination-gke-service=DESTINATION_GKE_SERVICE \
  --destination-gke-path=DESTINATION_GKE_PATH \
  --event-filters="type=EVENT_FILTER_TYPE" \
  --event-filters="instance=INSTANCE" \
  --event-filters-path-pattern="ref=REF" \
  --service-account=TRIGGER_SERVICE_ACCOUNT@PROJECT_ID.iam.gserviceaccount.com

Replace the following:

• TRIGGER: the ID of the trigger or a fully qualified identifier.

• LOCATION: the location of the Eventarc trigger. Alternatively, set the eventarc/location property; for example, gcloud config set eventarc/location us-central1. Firebase Realtime Database triggers for Eventarc are only available in the following locations:

  • us-central1
  • europe-west1
  • asia-southeast1

  Note that the trigger must be in the same location as the Firebase Realtime Database instance. For more information, see Realtime Database locations.

• DESTINATION_GKE_CLUSTER: the name of the GKE cluster in which the target GKE service that receives events is running.
• DESTINATION_GKE_LOCATION: the location in which the destination GKE service can be found. If not specified, it is assumed that the service is in the same region as the trigger. For more information see Cloud Run for Anthos on Google Cloud locations.
• DESTINATION_GKE_NAMESPACE: the namespace in which the destination GKE service is running. If not specified, the default namespace is used.
• DESTINATION_GKE_SERVICE: the name of the GKE service that receives the events for the trigger. The service can be in any of the GKE supported locations and does not need to be in the same location as the trigger. However, the service must be in the same project as the trigger and will receive events as HTTP POST requests sent to its root URL path (/), whenever the event is generated.
• (Optional) DESTINATION_GKE_PATH: the relative path you specify on the destination GKE service to which the events for the trigger should be sent. For example: /, /route, route, route/subroute.

• EVENT_FILTER_TYPE: the identifier of the Firebase Realtime Database event and can be one of the following:

  • google.firebase.database.ref.v1.created: event is sent when data is created in the database
  • google.firebase.database.ref.v1.updated: event is sent when data is updated in the database
  • google.firebase.database.ref.v1.deleted: event is sent when data is deleted in the database
  • google.firebase.database.ref.v1.written: event is sent when data is created, updated, or deleted in the database

• INSTANCE: a single database instance and the operator can be one of the following:

  • Equal; for example, --event-filters="instance=INSTANCE"
  • Path pattern; for example, --event-filters-path-pattern="instance=INSTANCE". For more information, see Understand path patterns.

• REF: the path within the database instance for which you want to receive events from when data is created, updated, or deleted in that path, or any of its children.

• TRIGGER_SERVICE_ACCOUNT: the IAM service account email associated with the trigger and to which you previously granted specific roles required by Eventarc. For example, $TRIGGER_SA@PROJECT_ID.iam.gserviceaccount.com

• PROJECT_ID: your Google Cloud project ID.

Notes:

• These flags are required:
  • --event-filters="type=EVENT_FILTER_TYPE"
  • --event-filters="instance=INSTANCE" or --event-filters-path-pattern="instance=INSTANCE"
  • --event-filters-path-pattern="ref=REF"
• After a trigger is created, the event filter type can't be changed. For a different event type, you must create a new trigger.
• The --service-account flag is used to specify the Identity and Access Management (IAM) service account email associated with the trigger.

Example:

gcloud eventarc triggers create rd-gke-trigger \
    --location=us-central1 \
    --destination-gke-cluster=gke-events-cluster \
    --destination-gke-location=us-central1-a \
    --destination-gke-namespace=default \
    --destination-gke-service=helloworld-events \
    --destination-gke-path=/ \
    --event-filters="type=google.firebase.database.ref.v1.created" \
    --event-filters="instance=test-instance" \
    --event-filters-path-pattern="ref=users/*" \
    --service-account=${PROJECT_NUMBER}[e-mail]

This command creates a trigger called rd-gke-trigger for the event identified as google.firebase.database.ref.v1.created.

Firebase Remote Config

gcloud eventarc triggers create TRIGGER \
  --location=global \
  --destination-gke-cluster=DESTINATION_GKE_CLUSTER \
  --destination-gke-location=DESTINATION_GKE_LOCATION \
  --destination-gke-namespace=DESTINATION_GKE_NAMESPACE \
  --destination-gke-service=DESTINATION_GKE_SERVICE \
  --destination-gke-path=DESTINATION_GKE_PATH \
  --event-filters="type=google.firebase.remoteconfig.remoteConfig.v1.updated" \
  --service-account=TRIGGER_SERVICE_ACCOUNT@PROJECT_ID.iam.gserviceaccount.com

Replace the following:

• TRIGGER: the ID of the trigger or a fully qualified identifier.
• DESTINATION_GKE_CLUSTER: the name of the GKE cluster in which the target GKE service that receives events is running.
• DESTINATION_GKE_LOCATION: the location in which the destination GKE service can be found. If not specified, it is assumed that the service is in the same region as the trigger. For more information see Cloud Run for Anthos on Google Cloud locations.
• DESTINATION_GKE_NAMESPACE: the namespace in which the destination GKE service is running. If not specified, the default namespace is used.
• DESTINATION_GKE_SERVICE: the name of the GKE service that receives the events for the trigger. The service can be in any of the GKE supported locations and does not need to be in the same location as the trigger. However, the service must be in the same project as the trigger and will receive events as HTTP POST requests sent to its root URL path (/), whenever the event is generated.
• (Optional) DESTINATION_GKE_PATH: the relative path you specify on the destination GKE service to which the events for the trigger should be sent. For example: /, /route, route, route/subroute.
• TRIGGER_SERVICE_ACCOUNT: the IAM service account email associated with the trigger and to which you previously granted specific roles required by Eventarc. For example, $TRIGGER_SA@PROJECT_ID.iam.gserviceaccount.com
• PROJECT_ID: your Google Cloud project ID

Notes:

• The --location flag must be global. For more information, see Eventarc locations.
• The --event-filters flag is required and the type must be google.firebase.remoteconfig.remoteConfig.v1.updated. An event is sent when a Remote Config template is updated.
• After a trigger is created, the event filter type can't be changed. For a different event type, you must create a new trigger.
• The --service-account flag is used to specify the Identity and Access Management (IAM) service account email associated with the trigger.

Example:

gcloud eventarc triggers create rc-gke-trigger \
    --location=global \
    --destination-gke-cluster=gke-events-cluster \
    --destination-gke-location=us-central1-a \
    --destination-gke-namespace=default \
    --destination-gke-service=helloworld-events \
    --destination-gke-path=/ \
    --event-filters="type=google.firebase.remoteconfig.remoteConfig.v1.updated" \
    --service-account=${TRIGGER_SA}@${PROJECT_ID}.iam.gserviceaccount.com

This command creates a trigger called rc-gke-trigger for the event identified as google.firebase.remoteconfig.remoteConfig.v1.updated.

Firebase Test Lab

gcloud eventarc triggers create TRIGGER \
  --location=global \
  --destination-gke-cluster=DESTINATION_GKE_CLUSTER \
  --destination-gke-location=DESTINATION_GKE_LOCATION \
  --destination-gke-namespace=DESTINATION_GKE_NAMESPACE \
  --destination-gke-service=DESTINATION_GKE_SERVICE \
  --destination-gke-path=DESTINATION_GKE_PATH \
  --event-filters="type=google.firebase.testlab.testMatrix.v1.completed" \
  --service-account=TRIGGER_SERVICE_ACCOUNT@PROJECT_ID.iam.gserviceaccount.com

Replace the following:

• TRIGGER: the ID of the trigger or a fully qualified identifier.
• DESTINATION_GKE_CLUSTER: the name of the GKE cluster in which the target GKE service that receives events is running.
• DESTINATION_GKE_LOCATION: the location in which the destination GKE service can be found. If not specified, it is assumed that the service is in the same region as the trigger. For more information see Cloud Run for Anthos on Google Cloud locations.
• DESTINATION_GKE_NAMESPACE: the namespace in which the destination GKE service is running. If not specified, the default namespace is used.
• DESTINATION_GKE_SERVICE: the name of the GKE service that receives the events for the trigger. The service can be in any of the GKE supported locations and does not need to be in the same location as the trigger. However, the service must be in the same project as the trigger and will receive events as HTTP POST requests sent to its root URL path (/), whenever the event is generated.
• (Optional) DESTINATION_GKE_PATH: the relative path you specify on the destination GKE service to which the events for the trigger should be sent. For example: /, /route, route, route/subroute.
• TRIGGER_SERVICE_ACCOUNT: the IAM service account email associated with the trigger and to which you previously granted specific roles required by Eventarc. For example, $TRIGGER_SA@PROJECT_ID.iam.gserviceaccount.com
• PROJECT_ID: your Google Cloud project ID

Notes:

• The --location flag must be global. For more information, see Eventarc locations.
• The --event-filters flag is required and the type must be google.firebase.testlab.testMatrix.v1.completed. An event is sent when a TestMatrix has completed.
• After a trigger is created, the event filter type can't be changed. For a different event type, you must create a new trigger.
• The --service-account flag is used to specify the Identity and Access Management (IAM) service account email associated with the trigger.

Example:

gcloud eventarc triggers create tl-gke-trigger \
    --location=global \
    --destination-gke-cluster=gke-events-cluster \
    --destination-gke-location=us-central1-a \
    --destination-gke-namespace=default \
    --destination-gke-service=helloworld-events \
    --destination-gke-path=/ \
    --event-filters="type=google.firebase.testlab.testMatrix.v1.completed" \
    --service-account=${TRIGGER_SA}@${PROJECT_ID}.iam.gserviceaccount.com

This command creates a trigger called tl-gke-trigger for the event identified as google.firebase.testlab.testMatrix.v1.completed.

Cloud IoT

Important: Google Cloud IoT Core is being retired on August 16, 2023. Contact your Google Cloud account team for more information.

gcloud eventarc triggers create TRIGGER \
  --location=LOCATION \
  --destination-gke-cluster=DESTINATION_GKE_CLUSTER \
  --destination-gke-location=DESTINATION_GKE_LOCATION \
  --destination-gke-namespace=DESTINATION_GKE_NAMESPACE \
  --destination-gke-service=DESTINATION_GKE_SERVICE \
  --destination-gke-path=DESTINATION_GKE_PATH \
  --event-filters="type=EVENT_FILTER_TYPE" \
  --event-filters="COLLECTION_ID=RESOURCE_ID" \
  --event-filters-path-pattern="COLLECTION_ID=PATH_PATTERN" \
  --service-account=SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com"

Replace the following:

• TRIGGER: the ID of the trigger or a fully qualified identifier.
• LOCATION: the location of the Eventarc trigger. To avoid any performance and data residency issues caused by a global trigger, it should match the location of the Google Cloud service that is generating events. Alternatively, you can set the eventarc/location property; for example gcloud config set eventarc/location us-central1. For more information, see Eventarc locations.
• DESTINATION_GKE_CLUSTER: the name of the GKE cluster in which the target GKE service that receives events is running.
• DESTINATION_GKE_LOCATION: the location in which the destination GKE service can be found. If not specified, it is assumed that the service is in the same region as the trigger. For more information see Cloud Run for Anthos on Google Cloud locations.
• DESTINATION_GKE_NAMESPACE: the namespace in which the destination GKE service is running. If not specified, the default namespace is used.
• DESTINATION_GKE_SERVICE: the name of the GKE service that receives the events for the trigger. The service can be in any of the GKE supported locations and does not need to be in the same location as the trigger. However, the service must be in the same project as the trigger and will receive events as HTTP POST requests sent to its root URL path (/), whenever the event is generated.
• (Optional) DESTINATION_GKE_PATH: the relative path you specify on the destination GKE service to which the events for the trigger should be sent. For example: /, /route, route, route/subroute.
• EVENT_FILTER_TYPE: the identifier of the event. An event is emitted when an API call for the method succeeds. For long-running operations, the event is only emitted at the end of the operation, and only if the action is performed successfully. For example, for the type, google.cloud.iot.v1.DeviceManager.CreateDeviceRegistry, an event is emitted when a registry is created through the version v1 in Cloud IoT. For more information on event types, see Event types supported by Eventarc.
• COLLECTION_ID (optional): the identifier of the event type. For example, for a Cloud IoT event, the COLLECTION_ID can be one of the following:
  • device
  • registry
    
• RESOURCE_ID: the identifier of the resource for the associated collection. For more information, see Resource ID.
• PATH_PATTERN: the path pattern to apply when filtering for the resource.
• SERVICE_ACCOUNT_NAME: the name of your user-managed service account.
• PROJECT_ID: your Google Cloud project ID.

Notes:

• The --event-filters="type=EVENT_FILTER_TYPE" flag is required. If no other event filter is set, events for all resources are matched.
• EVENT_FILTER_TYPE cannot be changed after creation. To change EVENT_FILTER_TYPE, create a new trigger and delete the old one.
• Each trigger can have multiple event filters, comma delimited in one --event-filters=[ATTRIBUTE=VALUE,...] flag, or you can repeat the flag to add more filters. Only events that match all the filters are sent to the destination. Wildcards and regular expressions are not supported; however, when using the --event-filters-path-pattern flag, you can define a resource path pattern.
• The following are some path pattern examples:
  • --event-filters-path-pattern="registry=my-registry-*" (matches events for registries whose name starts with my-registry-)
  • --event-filters-path-pattern="device=my-device-*" and --event-filters-path-pattern="registry=my-registry" (matches events for all devices whose name starts with "my-device-" in a registry named my-registry)
  • --event-filters-path-pattern="device=my-device-*" (matches events for all devices in any registry whose name starts with my-device-)
• The --service-account flag is used to specify the Identity and Access Management (IAM) service account email associated with the trigger.

Example:

gcloud eventarc triggers create cloud-iot-gke-trigger \
    --location=us-central1 \
    --destination-gke-cluster=gke-events-cluster \
    --destination-gke-location=us-central1-a \
    --destination-gke-namespace=default \
    --destination-gke-service=helloworld-events \
    --destination-gke-path=/ \
    --event-filters="type=google.cloud.iot.v1.DeviceManager.CreateDeviceRegistry" \
    --event-filters-path-pattern="registry=my-registry-*" \
    --service-account=${TRIGGER_SA}@${PROJECT_ID}.iam.gserviceaccount.com

This command creates a trigger called cloud-iot-gke-trigger for the event identified as google.cloud.iot.v1.DeviceManager.CreateDeviceRegistry and matches events for registry names starting with my-registry-.

Pub/Sub messages (existing topic)

gcloud eventarc triggers create TRIGGER \
    --location=LOCATION \
    --destination-gke-cluster=DESTINATION_GKE_CLUSTER \
    --destination-gke-location=DESTINATION_GKE_LOCATION \
    --destination-gke-namespace=DESTINATION_GKE_NAMESPACE \
    --destination-gke-service=DESTINATION_GKE_SERVICE \
    --destination-gke-path=DESTINATION_GKE_PATH \
    --event-filters="type=google.cloud.pubsub.topic.v1.messagePublished" \
    --transport-topic=projects/PROJECT_ID/topics/TOPIC_ID \
    --service-account=TRIGGER_SERVICE_ACCOUNT@PROJECT_ID.iam.gserviceaccount.com

Replace the following:

• TRIGGER: the ID of the trigger or a fully qualified identifier.
• LOCATION: the location of the Eventarc trigger. To avoid any performance and data residency issues caused by a global trigger, it should match the location of the Google Cloud service that is generating events. Alternatively, you can set the eventarc/location property; for example gcloud config set eventarc/location us-central1. For more information, see Eventarc locations.
• DESTINATION_GKE_CLUSTER: the name of the GKE cluster in which the target GKE service that receives events is running.
• DESTINATION_GKE_LOCATION: the location in which the destination GKE service can be found. If not specified, it is assumed that the service is in the same region as the trigger. For more information see Cloud Run for Anthos on Google Cloud locations.
• DESTINATION_GKE_NAMESPACE: the namespace in which the destination GKE service is running. If not specified, the default namespace is used.
• DESTINATION_GKE_SERVICE: the name of the GKE service that receives the events for the trigger. The service can be in any of the GKE supported locations and does not need to be in the same location as the trigger. However, the service must be in the same project as the trigger and will receive events as HTTP POST requests sent to its root URL path (/), whenever the event is generated.
• (Optional) DESTINATION_GKE_PATH: the relative path you specify on the destination GKE service to which the events for the trigger should be sent. For example: /, /route, route, route/subroute.
• PROJECT_ID your Google Cloud project ID
• TOPIC_ID: the ID of the existing Pub/Sub topic. The topic must be in the same project as the trigger.
• TRIGGER_SERVICE_ACCOUNT: the IAM service account email associated with the trigger and to which you previously granted specific roles required by Eventarc. For example, $TRIGGER_SA@PROJECT_ID.iam.gserviceaccount.com

Notes:

• The --event-filters="type=google.cloud.pubsub.topic.v1.messagePublished" flag is required and can't be changed. For a different event type, you must create a new trigger.
• Each trigger can have multiple event filters, comma delimited in one --event-filters=[ATTRIBUTE=VALUE,...] flag, or you can repeat the flag to add more filters. Only events that match all the filters are sent to the destination. Wildcards and regular expressions are not supported.
• The --transport-topic flag is used to specify the ID of the existing Pub/Sub topic or its fully qualified identifier.
• By default, Pub/Sub subscriptions created for Eventarc persist regardless of activity and do not expire. To change the inactivity duration, see Managing subscriptions.

Example:

  gcloud eventarc triggers create pubsub-gke-trigger-existing \
      --destination-gke-cluster=gke-events-cluster \
      --destination-gke-location=us-central1-a \
      --destination-gke-namespace=default \
      --destination-gke-service=helloworld \
      --destination-gke-path=/ \
      --event-filters="type=google.cloud.pubsub.topic.v1.messagePublished" \
      --transport-topic=projects/${PROJECT_ID}/topics/${TOPIC_ID} \
      --service-account=${TRIGGER_SA}@${PROJECT_ID}.iam.gserviceaccount.com

This creates a trigger called pubsub-gke-trigger-existing for the Pub/Sub topic identified by projects/${PROJECT_ID}/topics/${TOPIC_ID}.

Pub/Sub messages (new topic)

gcloud eventarc triggers create TRIGGER \
    --location=LOCATION \
    --destination-gke-cluster=DESTINATION_GKE_CLUSTER \
    --destination-gke-location=DESTINATION_GKE_LOCATION \
    --destination-gke-namespace=DESTINATION_GKE_NAMESPACE \
    --destination-gke-service=DESTINATION_GKE_SERVICE \
    --destination-gke-path=DESTINATION_GKE_PATH \
    --event-filters="type=google.cloud.pubsub.topic.v1.messagePublished" \
    --service-account=TRIGGER_SERVICE_ACCOUNT@PROJECT_ID.iam.gserviceaccount.com

Replace the following:

• TRIGGER: the ID of the trigger or a fully qualified identifier.
• LOCATION: the location of the Eventarc trigger. To avoid any performance and data residency issues caused by a global trigger, it should match the location of the Google Cloud service that is generating events. Alternatively, you can set the eventarc/location property; for example gcloud config set eventarc/location us-central1. For more information, see Eventarc locations.
• DESTINATION_GKE_CLUSTER: the name of the GKE cluster in which the target GKE service that receives events is running.
• DESTINATION_GKE_LOCATION: the location in which the destination GKE service can be found. If not specified, it is assumed that the service is in the same region as the trigger. For more information see Cloud Run for Anthos on Google Cloud locations.
• DESTINATION_GKE_NAMESPACE: the namespace in which the destination GKE service is running. If not specified, the default namespace is used.
• DESTINATION_GKE_SERVICE: the name of the GKE service that receives the events for the trigger. The service can be in any of the GKE supported locations and does not need to be in the same location as the trigger. However, the service must be in the same project as the trigger and will receive events as HTTP POST requests sent to its root URL path (/), whenever the event is generated.
• (Optional) DESTINATION_GKE_PATH: the relative path you specify on the destination GKE service to which the events for the trigger should be sent. For example: /, /route, route, route/subroute.
• TRIGGER_SERVICE_ACCOUNT: the IAM service account email associated with the trigger and to which you previously granted specific roles required by Eventarc. For example, $TRIGGER_SA@PROJECT_ID.iam.gserviceaccount.com
• PROJECT_ID your Google Cloud project ID

Notes:

• The --event-filters="type=google.cloud.pubsub.topic.v1.messagePublished" flag is required and can't be changed. For a different event type, you must create a new trigger.
• Each trigger can have multiple event filters, comma delimited in one --event-filters=[ATTRIBUTE=VALUE,...] flag, or you can repeat the flag to add more filters. Only events that match all the filters are sent to the destination. Wildcards and regular expressions are not supported.
• By default, Pub/Sub subscriptions created for Eventarc persist regardless of activity and do not expire. To change the inactivity duration, see Managing subscriptions.

Example:

  gcloud eventarc triggers create pubsub-gke-trigger-new \
      --location=us-central1 \
      --destination-gke-cluster=gke-events-cluster \
      --destination-gke-location=us-central1-a \
      --destination-gke-namespace=default \
      --destination-gke-service=helloworld \
      --destination-gke-path=/ \
      --event-filters="type=google.cloud.pubsub.topic.v1.messagePublished" \
      --service-account=${TRIGGER_SA}@${PROJECT_ID}.iam.gserviceaccount.com

This creates a new Pub/Sub topic and a trigger for it called pubsub-gke-trigger-new.

Note: Although your trigger is created immediately, it can take up to two minutes for a trigger to propagate and filter events.

Create a trigger using the Google Cloud console

You can create a trigger through the Google Cloud console. For details, see Create a trigger using the Google Cloud console.

List a trigger using the Google Cloud CLI

You can confirm the creation of a trigger by listing Eventarc triggers:

gcloud eventarc triggers list --location=LOCATION

Replace LOCATION with the ID or fully qualified identifier of the Eventarc trigger location; for example, us-central1.

For more information on managing Eventarc triggers, see Manage triggers.

What's next

To get started using Eventarc for GKE, see the quickstarts.