If you are creating a new function, see the Console Quickstart on Cloud Run. The content on this page only applies to existing legacy functions created with the Cloud Functions v2 API.
Stay organized with collections
Save and categorize content based on your preferences.
Restrict new deployments by product version
Cloud Run functions offers two product versions:
Cloud Run functions (1st gen) and Cloud Run functions created through the
Google Cloud Functions v2 APIs. If your organization wants to enforce a
restriction specifying that only one of the versions can be used to deploy new
functions, you can define a new
organization policy
with the
constraintconstraints/cloudfunctions.restrictAllowedGenerations. You use this constraint
to specify the generation (version) you want to allow or deny in the folder or
project the policy is applied to.
The restriction will only apply to new functions being deployed for the first
time. You will still be able to redeploy existing functions even if they
don't comply with the policy.
You can use Google Cloud CLI to create a policy restricting new
Cloud Run functions from being deployed for the first time within a given
organization to the specified environment.
Note that setting a policy does not apply to existing functions. All functions
that were deployed before the policy can be redeployed, updated, or deleted
without restriction.
To create a policy that restricts new Cloud Run functions, run the following command:
where ORGANIZATION_NUMBER is the number of the
organization to which you want to apply the policy, and
VERSION is the Cloud Run functions version that must be
used for new deployments. VERSION can be one of the
following:
1stGen: Allow the use of Cloud Run functions (1st gen) only.
2ndGen: Allow the use of Cloud Run functions (2nd gen) only.
To explicitly allow both environments, specify 1stGen and 2ndGen
together. By default, both environments are allowed when no policy is set.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-04-17 UTC."],[[["Cloud Run functions have two versions, 1st gen and 2nd gen, and organizations can restrict new deployments to a specific version using organization policies."],["The `constraints/cloudfunctions.restrictAllowedGenerations` constraint allows specifying which Cloud Run function version (1stGen or 2ndGen) can be used for new deployments within a folder or project."],["Setting this restriction only applies to new function deployments; existing functions can still be redeployed regardless of the policy."],["To create or modify organization policies, the account must have the `roles/orgpolicy.policyAdmin` role."],["You can use the Google Cloud CLI to enforce these restrictions by using the `gcloud resource-manager org-policies allow cloudfunctions.restrictAllowedGenerations` command."]]],[]]
