[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-17。"],[[["\u003cp\u003eCloud Deploy automations execute delivery pipeline tasks, such as promoting a release or advancing a rollout.\u003c/p\u003e\n"],["\u003cp\u003eAutomations rely on two primary resources: the \u003ccode\u003eAutomation\u003c/code\u003e, which defines the automation process, and the \u003ccode\u003eAutomationRun\u003c/code\u003e, which represents an execution of an automation rule.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eAutomation\u003c/code\u003e resource includes a target selector, an automation rule, metadata, a suspended property, and a specified service account to perform the automation.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eAutomation\u003c/code\u003e resource is a child of the delivery pipeline, meaning deleting a delivery pipeline also deletes its automations.\u003c/p\u003e\n"],["\u003cp\u003eThe automation service account, which must be explicitly defined in the \u003ccode\u003eAutomation\u003c/code\u003e configuration, requires specific permissions, including the ability to \u003ccode\u003eactAs\u003c/code\u003e the execution service account and permissions to perform the automated operations.\u003c/p\u003e\n"]]],[],null,["# About the automation resource\n\nThis document describes the Cloud Deploy resources used to execute\n[automations](/deploy/docs/automation).\n\nYou can configure Cloud Deploy to automatically perform certain delivery\npipeline tasks, such as promote a release or advance a rollout to a given phase.\nThese automations rely on two Cloud Deploy resources:\n\n- The `Automation` itself\n\n- The `AutomationRun`\n\nThese resources are described in this document.\n\nThe `Automation` resource\n-------------------------\n\nAn `Automation` is a Cloud Deploy resource that defines how to automate\none or more delivery pipeline tasks. The `Automation` associates one or more\ntarget resources with one or more automation `rules`.\n\nThe `Automation` resource includes the following:\n\n- A reference to the target (or targets) against which to perform the automation\n (the `selector`).\n\n- An automation rule that determines how to do the automation.\n\n- Metadata, such as `description`, `annotations`, and `labels`.\n\n- A `suspended` property.\n\n- The service account to use to perform the automation. The service account is\n required, and it must have the\n [necessary permissions](/deploy/docs/automation#roles_and_permissions_required)\n to perform the automation. Automation doesn't assume a default service\n account.\n\nThe `Automation` resource is a child resource of the\n[delivery pipeline](/deploy/docs/architecture#resources); if you\n[delete a delivery pipeline](/deploy/docs/delete-pipeline), all automations that\nare children of that pipeline are also deleted.\n\nThe [configuration file schema](/deploy/docs/config-files#automation_definitions)\ndescribes how to configure the `Automation`.\n\nThe `AutomationRun` resource\n----------------------------\n\nAn `AutomationRun` represents an execution of an\n[automation rule](/deploy/docs/automation-rules).\n\nThe automation service account\n------------------------------\n\nThe service account you use to invoke an automation can be the\n[default service account](/deploy/docs/cloud-deploy-service-account#execution_service_account)\nor another service account. However, even if you're using the default service\naccount, you must specify it, using the `serviceAccount` property in the\n`Automation` configuration.\n\nThe automation service account must have `iam.serviceAccount.actAs` permission\non the\n[applicable execution service account](/deploy/docs/cloud-deploy-service-account#execution_service_account).\nAlso, if the automation service account isn't in the same project as the\ndelivery pipeline, the Cloud Deploy\n[service agent](/deploy/docs/cloud-deploy-service-account#service_agent) must\nhave `iam.serviceAccount.actAs` on the automation service account.\n\n### Required permissions on the automation service account\n\nWhether you specify the default or a non-default service account for an\nautomation, the service account must have the following permissions:\n\n- Permission to `actAs` the\n [execution service account](/deploy/docs/cloud-deploy-service-account#execution_service_account).\n\n- [Permissions](/deploy/docs/iam-roles-permissions#permissions) to perform the operations that are being automated. See the\n [automation rules](/deploy/docs/automation-rules) for specific permission\n requirements.\n\nWhat's next\n-----------\n\n- Try the [quickstart: Automate release creation and rollout advancement](/deploy/docs/deploy-app-automation).\n\n- Read about [automation rules](/deploy/docs/automation-rules)."]]
