Apply custom constraints for projects

As an organization administrator, you can create custom constraints for Cloud Run services and jobs. Organization policies enforce these custom constraints at the project, folder, or organization level.

This page details how to create custom constraints for services and jobs and enforce them at the project level. For information about custom organization policies, see Creating and managing custom organization policies.

Cloud Run lets you write any number of custom constraints using most user-configured fields in the Cloud Run Admin API. For example, you can create a custom constraint that blocks services or jobs from setting the launch stage to Alpha or Beta.

Once applied, requests that violate a policy that enforces a custom constraint show an error message in the gcloud CLI and in Cloud Run logs. The error message contains the constraint ID and description of the violated custom constraint.

Before you begin

You must have the organization policy administrator role roles/orgpolicy.policyAdmin to create and view customer organization policies. See required roles.

Limitations

Cloud Run custom constraints must be specified by using the Cloud Run Admin API v1 field specifications.
Labels and top-level fields are not supported.

Customize common constraints

The following examples demonstrate how to specify custom constraints for common use cases using the gcloud CLI. For Google Cloud console instructions, see Creating and managing custom organization policies.

Restrict ingress settings
Require a maximum memory limit
Prevent non-GA launch stages
Require Binary Authorization
Require a liveness probe for every container
Require a sidecar through a container image prefix and port

Restrict ingress settings

Create a custom constraint that restricts the ingress setting of new or revised Cloud Run services, and then enforce the custom constraint at the project level.

To specify a custom constraint that requires a service to be set to "Internal" using the Google Cloud CLI, perform the following steps:

Create a new ingressConstraint.yaml file with the following content:

  name: organizations/ORGANIZATION_ID/customConstraints/custom.ingressInternal
  resourceTypes:
  - run.googleapis.com/Service
  methodTypes:
  - CREATE
  - UPDATE
  condition: "'run.googleapis.com/ingress' in resource.metadata.annotations && resource.metadata.annotations['run.googleapis.com/ingress'] == 'internal'"
  actionType: ALLOW
  displayName: IngressInternal
  description: Require ingress to be set to internal

Replace ORGANIZATION_ID with the ID of your organization.

Add the custom constraint by running the following command:

gcloud org-policies set-custom-constraint /ingressConstraint.yaml

Specify a new policy that enforces the custom constraint created in the previous step by creating a new enforceIngressConstraint.yaml file with the following content:
```
  name: projects/PROJECT_ID/policies/ingressInternal
  spec:
    rules:
      - enforce: true
```
Replace PROJECT_ID with the ID of your project.

Set the new policy by running the following command:

gcloud org-policies set-policy /enforceIngressConstraint.yaml

Require a maximum memory limit

Require all containers of new or revised Cloud Run services to have a memory limit that's set to less than a particular value.

To require a custom memory limit for the service's container using the Google Cloud CLI, perform the following steps:

Create a new memorylimitConstraint.yaml file with the following content:

  name: organizations/ORGANIZATION_ID/customConstraints/custom.memoryLimit
  resourceTypes:
  - run.googleapis.com/Service
  methodTypes:
  - CREATE
  - UPDATE
  condition: "resource.spec.template.spec.containers.all(container, 'memory' in container.resources.limits && container.resources.limits['memory'] <= 'MEMORY_LIMIT')"
  actionType: ALLOW
  displayName: memoryLimitCap
  description: Require the container memory limit to be set to <= MEMORY_LIMIT

Replace:

ORGANIZATION_ID with the ID of your organization.
MEMORY_LIMIT with the memory limit you want to set.

Add the custom constraint by running the following command:

gcloud org-policies set-custom-constraint /memorylimitConstraint.yaml

Specify a new policy that enforces the custom constraint created in the previous step by creating a new enforceMemorylimitConstraint.yaml file with the following content:
```
  name: projects/PROJECT_ID/policies/custom.memoryLimit
  spec:
    rules:
      - enforce: true
```
Replace PROJECT_ID with the ID of your project.

Set the new policy by running the following command:

gcloud org-policies set-policy /enforceMemorylimitConstraint.yaml

Prevent non-GA launch stages

Prevent the Cloud Run launch stage from being changed from default GA to Alpha or Beta.

To prevent the launch stage from being set to a non-GA launch stage, do the following:

Create a new launchstageConstraint.yaml file with the following content:

  name: organizations/ORGANIZATION_ID/customConstraints/custom.launchStage
  resourceTypes:
  - run.googleapis.com/Service
  methodTypes:
  - CREATE
  - UPDATE
  condition: "!('run.googleapis.com/launch-stage' in resource.metadata.annotations)"
  actionType: ALLOW
  displayName: launchStage
  description: Only allow unset launch stage (default is GA).

Replace ORGANIZATION_ID with the ID of your organization.

Add the custom constraint by running the following command:

gcloud org-policies set-custom-constraint /launchstageConstraint.yaml

Specify a new policy that enforces the custom constraint created in the previous step by creating a new enforceLaunchstageConstraint.yaml file with the following content:
```
  name: projects/PROJECT_ID/policies/launchStage
  spec:
    rules:
      - enforce: true
```
Replace PROJECT_ID with the ID of your project.

Set the new policy by running the following command:

gcloud org-policies set-policy /enforceLaunchstageConstraint.yaml

Require Binary Authorization

Require Binary Authorization to be set to default.

To require that Binary Authorization is set to default, perform the following steps:

Create a new binaryauthorizationConstraint.yaml file with the following content:

  name: organizations/ORGANIZATION_ID/customConstraints/custom.binaryAuthorization
  resourceTypes:
  - run.googleapis.com/Service
  methodTypes:
  - CREATE
  - UPDATE
  condition: "'run.googleapis.com/binary-authorization' in resource.metadata.annotations && resource.metadata.annotations['run.googleapis.com/binary-authorization'] == 'default'"
  actionType: ALLOW
  displayName: binaryAuthorization
  description: Require binaryAuthorization to be set to default.

Replace ORGANIZATION_ID with the ID of your organization.

Add the custom constraint by running the following command:

gcloud org-policies set-custom-constraint /binaryauthorizationConstraint.yaml

Specify the new policy that enforces the custom constraint created in the previous step by creating a new enforceBinaryauthorizationConstraint.yaml file with the following content:
```
  name: projects/PROJECT_ID/policies/binaryAuthorization
  spec:
    rules:
      - enforce: true
```
Replace PROJECT_ID with the ID of your project.

Set the new policy by running the following command:

gcloud org-policies set-policy /enforceBinaryauthorizationConstraint.yaml

Require a liveness probe for every container

Require that services have a liveness probe for every container by requiring that the livenessProbe.initialDelaySeconds field is set to a value.

To require a liveness probe for every container, perform the following steps:

Create a new livenessprobeConstraint.yaml file with the following content:

  name: organizations/ORGANIZATION_ID/customConstraints/custom.livenessProbe
  resourceTypes:
  - run.googleapis.com/Service
  methodTypes:
  - CREATE
  - UPDATE
  condition: "resource.spec.template.spec.containers.all(container, has(container.livenessProbe.initialDelaySeconds))"
  actionType: ALLOW
  displayName: livenessProbe
  description: Require all containers to have a liveness probe configured with initialDelaySeconds.

Replace ORGANIZATION_ID with the ID of your organization.

Add the custom constraint by running the following command:

gcloud org-policies set-custom-constraint /livenessprobeConstraint.yaml

Specify a new policy that enforces the custom constraint created in the previous step by creating a new enforceLivenessprobeConstraint.yaml file with the following content:
```
  name: projects/PROJECT_ID/policies/livenessProbe
  spec:
    rules:
      - enforce: true
```
Replace PROJECT_ID with the ID of your project.

Set the new policy by running the following command:

gcloud org-policies set-policy /enforceLivenessprobeConstraint.yaml

Require a sidecar through a container image prefix and port

Require that a service has at least one sidecar container that uses an image beginning with a specified prefix and a port equal to a specified number.

To require that a container begins with a set prefix and uses PORT = 8081, perform the following steps:

Create a new requireSidecarConstraint.yaml file with the following content:

  name: organizations/ORGANIZATION_ID/customConstraints/custom.requireSidecar
  resourceTypes:
  - run.googleapis.com/Service
  methodTypes:
  - CREATE
  - UPDATE
  condition: "resource.spec.template.spec.containers.exists(container, container.image.startsWith('us-docker.pkg.dev/cloud-ops-agents-artifacts/cloud-run-gmp-sidecar/') && container.ports.exists(port, port.containerPort == 8081))"
  actionType: ALLOW
  displayName: requireSidecar
  description: Require at least one container with an image that starts with "us-docker.pkg.dev/cloud-ops-agents-artifacts/cloud-run-gmp-sidecar/" and uses port 8081

Replace ORGANIZATION_ID with the ID of your organization.

Add the custom constraint by running the following command:

  gcloud org-policies set-custom-constraint /requireSidecarConstraint.yaml

Specify a new policy that enforces the custom constraint created in the previous step by creating a new enforceRequireSidecarConstraint.yaml file with the following content:
```
  name: projects/PROJECT_ID/policies/requireSidecar
  spec:
    rules:
      - enforce: true
```
Replace PROJECT_ID with the ID of your project.

Set the new policy by running the following command:

gcloud org-policies set-policy /enforceRequireSidecarConstraint.yaml