Check for the Maximum Number of Container Instances

Risk Level: Medium (should be achieved)

To prevent uncontrolled scaling, resource exhaustion, and unexpected costs, ensure that your Cloud Run services are configured with an optimal maximum number of allocated instances. Before running this conformity rule, you must define the maximum number of container instances in the rule settings, in your Trend Micro Cloud One™ – Conformity account.

Cost
optimisation

Operational
excellence

You can control your Cloud Run service scaling behavior by setting a maximum number of container instances. This limits costs and prevents overwhelming downstream resources with traffic. Cloud Run services scale by creating new instances to handle requests. Each instance can process only one request at a time, so large traffic spikes can lead to many new instances. Setting an optimal maximum number of instances ensures efficient resource utilization and timely response to incoming requests, balancing cost and performance.

Audit

To determine if your Cloud Run services are configured with a maximum number of instances, perform the following operations:

Using GCP Console

01 Sign in to your Trend Micro Cloud One™ – Conformity account, open the Check for the Maximum Number of Container Instances conformity rule settings, and identify the maximum number of instances that your Cloud Run services can deploy.

02 Sign in to the Google Cloud Management Console.

03 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

04 Navigate to Cloud Run console available at https://console.cloud.google.com/run/.

05 Select the SERVICES tab to view the Cloud Run services deployed for the selected GCP project.

06 Click on the name (link) of the service that you want to examine, listed in the Name column.

07 Select the REVISIONS tab and choose the active revision used by the selected service (the revision with the green check mark icon).

08 Select the CONTAINERS tab, and compare the Revision max instances value, listed under Autoscaling, with the maximum number of instances allowed by your organization (identified in step 1). If the configured maximum instances for the selected Cloud Run service exceed the authorized limit in the conformity rule settings, the Cloud Run service autoscaling configuration is non-compliant. This could lead to unrestricted scaling, potentially causing resource exhaustion and increased costs.

09 Repeat steps no. 6 - 8 for each Cloud Run service created for the selected GCP project.

10 Repeat steps no. 2 - 9 for each project deployed within your Google Cloud account.

Using GCP CLI

01 Sign in to your Trend Micro Cloud One™ – Conformity account, open the **Check for the Maximum Number of Container Instances** conformity rule settings, and identify the maximum number of instances that your Cloud Run services can deploy.

02 Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each project available in your Google Cloud Platform (GCP) account:

gcloud projects list
	--format="value(projectId)"

03 The command output should return the requested GCP project ID(s):

cc-bigdata-project-123123
cc-iot-app-project-112233

04 Run services list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to describe the name and the region of each Cloud Run service deployed within the selected project:

gcloud run services list
	--project cc-bigdata-project-123123
	--format="(NAME,REGION)"

05 The command output should return the requested service names and the associated regions:

NAME: cc-project5-service
REGION: us-central1

NAME: tm-stream-service
REGION: us-central1

NAME: tm-vertex-service
REGION: us-central1

06 Run services describe command (Windows/macOS/Linux) with the name of the Cloud Run service that you want to examine as the identifier parameter, to describe the maximum number of instances configured for the selected service:

gcloud run services describe cc-project5-service
	--region=us-central1
	--format="json(spec.template.metadata.annotations.'autoscaling.knative.dev/maxScale')"

07 The command output should return the maximum number of container instances configured:

Compare the value returned by the services describe command output with the maximum number of instances allowed by your organization (identified in step 1). If the configured maximum instances for the selected Cloud Run service exceed the authorized limit in the conformity rule settings, the Cloud Run service autoscaling configuration is non-compliant. This may allow it to scale without restriction, potentially causing resource exhaustion and increased costs.

08 Repeat steps no. 6 and 7 for each Cloud Run service created for the selected GCP project.

09 Repeat steps no. 4 – 8 for each GCP project deployed in your Google Cloud account.

Remediation / Resolution

To ensure that your Cloud Run Services have an optimal number of instances configured, set the maximum number of container instances by following these steps:

Using GCP Console

02 Sign in to the Google Cloud Management Console.

03 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

04 Navigate to Cloud Run console available at https://console.cloud.google.com/run/.

05 Select the SERVICES tab to access the Cloud Run services deployed for the selected GCP project.

06 Click on the name (link) of the service that you want to configure, listed in the Name column.

07 Choose EDIT & DEPLOY NEW REVISION, select the CONTAINER(S) tab, and enter the maximum number of service instances authorized by your organization (identified in step 1), in the Maximum number of instances box. The maximum number of service instances should be determined according to your workload's performance needs while staying within your organization's budget guidelines. Choose DEPLOY to apply the changes and deploy a new revision for the selected service.

08 Repeat steps no. 6 and 7 for each Cloud Run service that you want to configure, available within the selected project.

09 Repeat steps no. 2 – 8 for each project deployed in your Google Cloud account.

Using GCP CLI

02 Run services update command (Windows/macOS/Linux) with the name of the Cloud Run service that you want to configure as the identifier parameter, to set the maximum number of container instances authorized by your organization, identified in step 1. The maximum number of instances should be determined according to your workload's performance needs while staying within your organization's budget guidelines:

gcloud run services update cc-project5-service
	--region=us-central1
	--max-instances=10

03 The command output should return the build information available for the redeployed service:

OK Deploying... Done.
	OK Creating Revision...
	OK Routing traffic...
Done.

Service [cc-project5-service] revision [cc-project5-service-00003-abc] has been deployed and is serving 100 percent of traffic.
Service URL: https://cc-project5-service-123456789012.us-central1.run.app

04 Repeat steps no. 2 and 3 for each Cloud Run service that you want to configure, available in the selected project.

05 Repeat steps no. 1 – 4 for each GCP project deployed in your Google Cloud account.

References

GCP Command Line Interface (CLI) Documentation
gcloud projects list
gcloud run services list
gcloud run services describe
gcloud run services update

Publication date Nov 19, 2024

Audit

Using GCP Console

Using GCP CLI

Remediation / Resolution

Using GCP Console

Using GCP CLI

References

Related CloudRun rules