En el panel Service account permissions (Permisos de la cuenta de servicio), establece el estado de la función de administrador de Cloud Run en Habilitar:
Selecciona OTORGAR ACCESO A TODAS LAS CUENTAS DE SERVICIO para otorgar la función de usuario de cuenta de servicio en todas las cuentas de servicio del proyecto en tu página.
Haz clic en Activadores, en el panel de navegación izquierdo, para abrir la página Activadores:
En el campo Nombre, ingresa un nombre para el activador.
En Evento, selecciona el evento del repositorio para iniciar el activador.
En Fuente, selecciona el repositorio y el nombre de la rama o de la etiqueta que iniciará el activador.
Para obtener más información sobre cómo especificar qué ramas se deben compilar de manera automática, consulta Crea un activador de compilación.
En Archivo de configuración de Cloud Build (YAML o JSON), selecciona Archivo de configuración de Cloud Build.
En el campo Ubicación del archivo de configuración de Cloud Build, escribe cloudbuild.yaml después de /.
Haz clic en Crear para guardar el activador de compilación.
Ya terminaste. A partir de ahora, cada vez que hagas envíos al repositorio, se invocarán de forma automática una compilación y una implementación en tu servicio de Cloud Run.
Implementación continua con permisos de IAM mínimos
Cuando un contenedor se implementa en un servicio de Cloud Run, se ejecuta con la identidad de la cuenta de servicio del entorno de ejecución de este servicio de Cloud Run.
Debido a que Cloud Build puede implementar contenedores nuevos de forma automática, Cloud Build debe poder actuar como la cuenta de servicio del entorno de ejecución del servicio de Cloud Run.
A fin de otorgar acceso limitado a Cloud Build para implementar en un servicio de Cloud Run, sigue estos pasos:
IU de Console
Ve a la página Cuentas de servicio de la Google Cloud consola:
Haz clic en la dirección de correo electrónico de la cuenta de servicio del entorno de ejecución del servicio de Cloud Run de tu Cloud Run (de forma predeterminada, es PROJECT_NUMBER-compute@developer.gserviceaccount.com).
Haz clic en la pestaña Permisos.
Haz clic en person_addGrant access.
Ingresa la cuenta de servicio de Cloud Build (PROJECT_NUMBER@cloudbuild.gserviceaccount.com).
En el menú desplegable Seleccionar un rol, selecciona la función Cuentas de servicio>Usuario de cuenta de servicio.
Haz clic en Guardar.
gcloud
Usa el comando gcloud iam service-accounts add-iam-policy-binding:
Si usas Cloud Run mediante una identidad de servicio personalizada, reemplaza PROJECT_NUMBER-compute@developer.gserviceaccount.com por la dirección de la cuenta de servicio.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-04 (UTC)"],[],[],null,["# Manual setup continuous deployment using Cloud Build\n\nThe following instructions assume you have a git repository with a `Dockerfile` at its root.\n\n\u003cbr /\u003e\n\nTo automate deployment from Git with Cloud Build:\n\n1. Construct a Cloud Build configuration that:\n\n - Builds the container image\n - Pushes the image to the Container Registry [(Deprecated)](/container-registry/docs/deprecations/container-registry-deprecation)\n - Deploys a new revision to the Cloud Run service\n\n To do this, add a file named `cloudbuild.yaml` *at the root of your repository*\n with this content: \n\n steps:\n # build the container image\n - name: 'gcr.io/cloud-builders/docker'\n args: ['build', '-t', 'gcr.io/$PROJECT_ID/[SERVICE-NAME]:$COMMIT_SHA', '.']\n # push the container image to Container Registry\n - name: 'gcr.io/cloud-builders/docker'\n args: ['push', 'gcr.io/$PROJECT_ID/[SERVICE-NAME]:$COMMIT_SHA']\n # Deploy container image to Cloud Run\n - name: 'gcr.io/cloud-builders/gcloud'\n args:\n - 'run'\n - 'deploy'\n - '[SERVICE-NAME]'\n - '--image'\n - 'gcr.io/$PROJECT_ID/[SERVICE-NAME]:$COMMIT_SHA'\n - '--region'\n - '[REGION]'\n images:\n - 'gcr.io/$PROJECT_ID/[SERVICE-NAME]:$COMMIT_SHA'\n\n Replace\n - \u003cvar translate=\"no\"\u003e[SERVICE-NAME]\u003c/var\u003e with the name of the Cloud Run service.\n - \u003cvar translate=\"no\"\u003e[REGION]\u003c/var\u003e with the region of the Cloud Run service you are deploying.\n\n The use of the `$COMMIT_SHA` substitution variable is populated by Cloud Build\n when triggered from a Git repository.\n2. Grant the *Cloud Run Admin* and *Service Account User* roles to the\n Cloud Build service account:\n\n 1. Open the Cloud Build settings page in the Google Cloud console:\n\n [Visit the Cloud Build settings page](https://console.cloud.google.com/cloud-build/settings)\n 2. In the Service account permissions panel, set the status of the\n *Cloud Run Admin* role to **Enable**:\n\n 3. Select **GRANT ACCESS TO ALL SERVICE ACCOUNTS** to grant the\n **Service Account User** role on all service accounts in the project on\n your page.\n\n | **Note:** For stronger security, only allow Cloud Build to [act as a specific Cloud Run service](#continuous-iam).\n3. Click **Triggers** in the left navigation panel to open the *Triggers* page:\n\n [Visit the Triggers page](https://console.cloud.google.com/cloud-build/triggers)\n 1. Click **Create Trigger**.\n 2. In the **Name** field, enter a name for your trigger.\n 3. Under **Event**, select the repository event to start your trigger.\n 4. Under **Source** , select your repository and the branch or tag name that will start your trigger. For more information on specifying which branches to autobuild, see [Creating a build trigger](/build/docs/running-builds/automate-builds#build_trigger).\n 5. Under **Cloud Build configuration file (yaml or json)** , select **Cloud Build\n configuration file**.\n 6. In the **Cloud Build configuration file location** field, type `cloudbuild.yaml` after the `/`.\n 7. Click **Create** to save your build trigger.\n4. You are finished! From now on, whenever you push to your repository, a build\n and a deployment to your Cloud Run service is automatically invoked.\n\n| **Note:** To make the deployed service public, make a one-time change to the [service IAM settings](/run/docs/securing/managing-access#making_a_service_public).\n\nContinuous deployment with minimal IAM permissions\n--------------------------------------------------\n\nWhen a container is deployed to a Cloud Run service, it runs with the\nidentity of the Runtime Service Account of this Cloud Run service.\nBecause Cloud Build can deploy new containers automatically, Cloud Build\nneeds to be able to *act as* the [Runtime Service Account of your\nCloud Run service](/run/docs/securing/service-identity).\n\nTo grant limited access to Cloud Build to deploy to a Cloud Run service: \n\n### Console UI\n\n1. Go to the **Service accounts** page of the Google Cloud console:\n\n [Go to Service accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)\n\n \u003cbr /\u003e\n\n2. Click the email address of your Cloud Run service's Runtime\n Service Account of your Cloud Run (by default, it is\n \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`-compute@developer.gserviceaccount.com`).\n\n3. Click the **Permissions** tab.\n\n4. Click person_add **Grant access**.\n\n5. Enter the Cloud Build Service Account (\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@cloudbuild.gserviceaccount.com`)\n\n6. In the **Select a role** dropdown, select the **Service\n Accounts** \\\u003e **Service Account User** role.\n\n7. Click **Save**.\n\n### gcloud\n\nUse the `gcloud iam service-accounts add-iam-policy-binding` command: \n\n```bash\ngcloud iam service-accounts add-iam-policy-binding \\\n PROJECT_NUMBER-compute@developer.gserviceaccount.com \\\n --member=\"serviceAccount:\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@cloudbuild.gserviceaccount.com\" \\\n --role=\"roles/iam.serviceAccountUser\"\n```\n\nReplace \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e with the numeric ID of your project.\n\nIf using Cloud Run using a [customized service identity](/run/docs/securing/service-identity#per-service-identity),\nreplace `PROJECT_NUMBER-compute@developer.gserviceaccount.com` with your service\naccount address.\n\nSee [Deployment permissions](/run/docs/reference/iam/roles#additional-configuration)\nfor more information.\n\nWhat's Next\n-----------\n\n- Learn how deploy or publish a container image to a private registry in another project in [Setting service account permissions](/build/docs/securing-builds/set-service-account-permissions)"]]
