cloudrun-getting-started-create-subscription.sh

echo "create iam binding"
gcloud projects add-iam-policy-binding ${GCLOUD_PROJECT} \
    --member=serviceAccount:service-${PROJECT_NUMBER}@gcp-sa-pubsub.iam.gserviceaccount.com \
    --role=roles/iam.serviceAccountTokenCreator

echo "create service account"
gcloud iam service-accounts create ${INVOKER_NAME} \
    --display-name "Cloud Run Pub/Sub Invoker"

echo "iam roles"
gcloud beta run services add-iam-policy-binding ${PROJECT_NAME} \
    --member=serviceAccount:${INVOKER_NAME}@${GCLOUD_PROJECT}.iam.gserviceaccount.com \
    --role=roles/run.invoker

echo "create subscription"
gcloud beta pubsub subscriptions create ${SUBSCRIPTION_NAME} \
    --topic ${TOPIC_NAME} \
    --push-endpoint=${SERVICE_URL} \
    --push-auth-service-account=${INVOKER_NAME}@${GCLOUD_PROJECT}.iam.gserviceaccount.com