Goal: serve your Cloud Run service on your own domain with managed TLS.
Steps:
1. Verify domain ownership in Search Console (one-time per domain).
2. Create the domain mapping:
```
gcloud run domain-mappings create --service [SERVICE] --domain [DOMAIN] --region [REGION]
```
3. Add the DNS records the command outputs (A/AAAA or CNAME depending on setup) at your registrar.
4. Wait for certificate provisioning. This is not instant; it can take tens of minutes. The mapping shows status while provisioning.
Traps:
- DNS propagation vs provisioning: even after DNS resolves, the cert may still be provisioning. Check the mapping status, not just dig.
- Apex domains vs subdomains have different DNS record requirements. Read the output of the create command; it tells you exactly which records.
- Regional mappings: the domain mapping is per region. Multi-region services need multi-region mappings or a load balancer in front.
- Deleting the service does not delete the mapping; clean up mappings explicitly or the domain dangles.
Alternative for advanced setups: put a global external load balancer in front with a serverless NEG. More knobs (Cloud CDN, Cloud Armor), more config. Start with direct domain mapping unless you need those.
Verify: curl https://YOUR-DOMAIN returns your service, the cert is valid and auto-renewing, and http redirects to https.