Tag worker pools

Preview — Cloud Run worker pools

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of theService Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see thelaunch stage descriptions.

Tags are key-value pairs you can apply to your worker pools for fine-grained accesscontrol. Tags provides a way to conditionally allow or denypolicies based on whether a resource has a specific tag.

At the organization or project level, tag administrators create tags for resources across Google Cloud and manage them inResource Manager.

Note: In contrast to tags,labels are usedto identify resources for billing-related reasons, filtering logs, and so forth.

Required roles

To get the permissions that you need to attach or detach tags, ask your administrator to grant you the following IAM roles on the Cloud Run worker pool:

To manage access on the tag value resource in Resource Manager, youraccount must also have theTag User (roles/resourcemanager.tagUser) rolegranted for the tag value.The tag value is the resource that is attached to the Cloud Runworker pool.

For a list of IAM roles and permissions that are associated withCloud Run, seeCloud Run IAM rolesandCloud Run IAM permissions.If your Cloud Run worker pool interfaces withGoogle Cloud APIs, such as Cloud Client Libraries, see theservice identity configuration guide.For more information about granting roles, seedeployment permissionsandmanage access.

Attach tags

Note that attaching a tag to your worker pooldoes not result in the creationof a new revision.

You can attach tags using the Google Cloud CLI.

gcloud

You can update tags for a worker pool using the command:

gcloudresource-managertagsbindingscreate\--tag-value=TAG_VALUE\--parent=//run.googleapis.com/projects/PROJECT_ID/locations/REGION/workerpools/WORKER_POOL\--location=REGION

To update more than one tag, supply a comma-delimited list of key/value pairs.

Replace:

  • TAG_VALUE with the value for the key. You can use severaldifferent types of values, such as a permanent ID such astagValues/12345678901, a namespaced value such as123456789012/env/prod, or a short name such asprod.
  • PROJECT_ID with project ID of your Google Cloud project
  • REGION with region your Cloud Run worker pool is deployed to
  • WORKER_POOL with name of your Cloud Run worker pool

Detach a tag

Use the Google Cloud CLI to detach tags from your worker pool.

gcloud

To detach a tag from a worker pool:

gcloudresource-managertagsbindingsdelete\--tag-value=TAG_VALUE\--parent=//run.googleapis.com/projects/PROJECT_ID/locations/REGION/workerpools/WORKER_POOL\--location=REGION

To detach more than one tag, supply a comma-delimited list of key/value pairs.

Replace

  • TAG_VALUE with the value for the key: you can severaldifferent types of values: a permanent ID such astagValues/12345678901,a namespaced value such as123456789012/env/prod, or a short name such asprod.
  • PROJECT_ID with project ID of your Google Cloud project
  • REGION with region your Cloud Run worker pool is deployed to
  • WORKER_POOL with name of your Cloud Run worker pool

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-19 UTC.