Publish and receive events by creating a bus and enrollment (console)

Create a subnet and enable Private Google Access

Unless you create an organizational policy that prohibits it, new Google Cloud projects start with a default Virtual Private Cloud (VPC) network (an auto mode VPC network) that has one subnetwork (subnet) in each region. Subnets have IP address ranges associated with them.

Because you are routing messages to a Cloud Run destination using a DNS address, you must enable Private Google Access on the subnet used in the network attachment; otherwise, the DNS address can't be resolved. For more information about private networking and Cloud Run, see Receive requests from VPC networks.

Create a subnet in your project's default network and enable Private Google Access:

1. In the Google Cloud console, go to the VPC networks page.

   Go to VPC networks

2. In the list of VPC networks, click the default name.

3. In the VPC network details page, click the Subnets tab.

4. Click add_box Add subnet.

5. In the Add a subnet pane, do the following:

   1. Enter a Name—for example, my-subnet.
   2. In the Region list, select us-central1.
   3. Enter a Primary IPv4 range for the subnet—for example, 10.8.0.0/24.
   4. For Private Google Access, select On.
   5. Accept all the other defaults.
   6. Click Add.

Subnet IP ranges must be unique and non-overlapping within a VPC network and peered VPC network. For more information about subnet types and valid subnet ranges, see Subnets.

Create a network attachment

A network attachment is a resource that lets a producer VPC network initiate connections to a consumer VPC network. To publish events, Eventarc Advanced uses the network attachment to establish a connection to the endpoint hosted in a VPC network.

Create a network attachment in the same network and region containing the event destination endpoint, and that automatically accepts connections from any Private Service Connect interface that refers to the network attachment:

1. In the Google Cloud console, go to Private Service Connect.

   Go to Private Service Connect

2. Click the Network attachments tab.

3. Click add Create network attachment.

4. Enter a Name—for example, my-network-attachment.

5. In the Network list, select default.

6. In the Region list, select us-central1 (Iowa).

7. In the Subnetwork list, select the subnet you previously created.

8. Click Automatically accept connections for all projects.

9. Click Create network attachment.

Create an Artifact Registry standard repository

Create an Artifact Registry standard repository to store your container image.

1. In the Google Cloud console, go to the Repositories page.

   Go to Repositories

2. Click add Create repository.

3. Enter a Name—for example, my-repo.

   For each repository location in a project, repository names must be unique.

4. For the repository Format, select Docker.

5. In the Region list, select us-central1 (Iowa).

6. Accept all the other defaults.

7. Click Create.

Deploy an event receiver service to Cloud Run

Deploy a Cloud Run service that logs the contents of an event. This service is accessible only from VPC networks within the same project, and the service URL is not directly accessible because the service only allows authenticated invocations.

1. In your terminal, clone the GitHub repository:

   git clone https://github.com/GoogleCloudPlatform/eventarc-samples.git

2. Change to the directory that contains the Cloud Run sample code:

   cd eventarc-samples/eventarc-advanced-quickstart/

3. Build a Docker container image and push the image to your repository:

   gcloud builds submit \
       --tag $REGION-docker.pkg.dev/PROJECT_ID/REPOSITORY/log-events:v1

   Replace REPOSITORY with the name of your Artifact Registry repository.

4. Deploy the container image to Cloud Run:

   1. In the Google Cloud console, go to the Cloud Run page.

      Go to Cloud Run

   2. Click add_box Deploy container > Service.

   3. Select Deploy one revision from an existing container image.

   4. For the Container image URL, click Select to specify the Artifact Registry container image you previously created.

   5. Optionally, you can change the Service name—for example, to my-service.

   6. In the Region list, select us-central1 (Iowa).

   7. For Authentication, select Require authentication.

   8. For Ingress, select Internal.

   9. Accept all the other defaults.

   10. Click Create and wait for the deployment to finish.

Create an Eventarc Advanced bus

A bus receives event messages from a message source or published by a provider and acts as a message router.

For more information, see Create a bus to route messages.

1. In the Google Cloud console, go to the Eventarc > Bus page.

   Go to Bus

2. Click add_box Create bus.

3. On the Create a bus page, do the following:

   1. Enter a Bus name—for example, my-bus.
   2. In the Region list, select us-central1 (Iowa).

4. Accept all the other defaults.

5. Click Create.

Create an Eventarc Advanced enrollment

An enrollment determines which messages are routed to a destination and it also specifies the pipeline that is used to configure a destination for the event messages.

For more information, see Create an enrollment to receive events.

When using the Google Cloud console, you can create an enrollment and a pipeline at the same time.

1. To create an enrollment, in the Google Cloud console, go to the Eventarc > Pipelines page.

   Go to Pipelines

2. Click add_box Create pipeline.

3. In the Pipeline details pane, do the following:

   1. Enter a Pipeline name—for example, my-pipeline.
   2. In the Region list, select us-central1 (Iowa). The pipeline must be created in the same region as the bus.
   3. Accept all the other defaults.
   4. Click Continue.

4. In the Enrollments pane, do the following:

   1. Click Add an enrollment.
   2. Enter an Enrollment name—for example, my-enrollment.
   3. In the Eventarc Advanced Bus list, select the bus you previously created.

   4. In the CEL expression field, write an evaluation expression using CEL. For example:

      message.type == "hello-world-type"

   5. Click Done.

   6. Click Continue.

   7. In the Event mediation pane, click Continue again.

5. In the Destination pane, do the following:

   1. In the Destination type list, select Cloud Run service (via HTTP) and then select the Cloud Run service you previously created.

   2. In the Network attachment list, select the network attachment you previously created.

   3. Select the Enable authentication checkbox.

      1. In the Auth header list, select OIDC token.

      2. In the Service account list, select the service account that you previously created and that will invoke your destination service. This service account email is used to generate the OIDC token.

6. Click Create.

Publish an event message to the bus

To directly publish a message to your bus, you can use the gcloud beta eventarc message-buses publish command or send a request to the Eventarc Publishing REST API. For more information, see Publish events directly.

The message must be in a CloudEvents format which is a specification for describing event data in a common way. The data element is the payload of your event. Any well-formed JSON can go in this field. For more information about CloudEvents context attributes, see Event format.

Publish an event to your Eventarc Advanced bus using the gcloud CLI and an --event-data and other event attribute flags:

gcloud beta eventarc message-buses publish BUS_NAME \
    --event-data='{"key": "hello-world-data"}' \
    --event-id=hello-world-id-1234 \
    --event-source=hello-world-source \
    --event-type=hello-world-type \
    --event-attributes="datacontenttype=application/json" \
    --location=$REGION

Or, publish an event to your Eventarc Advanced bus as a JSON message using the gcloud CLI and a --json-message flag:

gcloud beta eventarc message-buses publish BUS_NAME \
    --location=$REGION \
    --json-message='{"id": "hello-world-id-1234", "type":
 "hello-world-type", "source":
 "hello-world-source", "specversion": "1.0", "data":
 {"key": "hello-world-data"}}'

After publishing an event, you should receive an "Event published successfully" message.

View the event data in the Cloud Run logs

After publishing an event to your Eventarc Advanced bus, you can check the logs of your Cloud Run service to verify that the event was received as expected.

1. In the Google Cloud console, go to the Cloud Run page.

   Go to Cloud Run

2. On the Services page, click the name of your service.

3. Click the Logs tab.

4. You can filter the log entries and return the output. For example, you can search for hello-world-data.

5. Look for a log entry similar to the following:

   2025-02-27 08:36:44.350 EST [2025-02-27 13:36:44,352] INFO in server: Body: b'{"key": "hello-world-data"}'
   

You have successfully created an Eventarc Advanced bus and enrollment, published an event message to the bus, and verified the expected outcome in the logs of the event receiver service.