Cloud Functions Gen 2 metadata changed after disabling Cloud Run Invoker IAM check

Google Cloud Serverless Applications
,
1

Hi Google Cloud community,

I’m looking for clarification about metadata changes observed on a Cloud Run service backing a Cloud Functions Gen 2 function.

I used the documented command to disable the Cloud Run Invoker IAM check on an existing Gen 2 function backing service:

gcloud run services update SERVICE_NAME --no-invoker-iam-check --region=REGION --platform=managed

The update completed successfully.

Our pre/post verification confirmed that the following remained unchanged:

  • Service UID
  • Ready revision
  • Application container image digest
  • Runtime service account
  • Numeric Secret Manager version binding
  • Revision configuration
  • Traffic (100% to the same single revision, no tags)
  • IAM policy
  • No allUsers binding

The expected service-level state changed successfully to:

invokerIamDisabled=true

However, we observed two metadata differences that we would like to understand before applying the same update to another production service.

  1. The Cloud Run v2 Service annotations gained:

cloudfunctions.googleapis.com/function-id

Is this annotation expected Cloud Functions / Cloud Run control-plane metadata when updating the Invoker IAM check on a Gen 2 function backing service?

What is its behavioral meaning, and does its addition preserve the existing Cloud Functions Gen 2 function association and runtime behavior?

  1. The protected v1 service-annotation set also produced a different pre/post hash.

We no longer have sufficient historical field-level values to identify the exact v1 annotation differences, while the independently verified runtime, revision, image, identity, secret, traffic, and IAM invariants remained unchanged.

Are there known Cloud Run / Cloud Functions / gcloud client or reconciliation annotations that may be added, removed, or normalized by this update?

We are specifically trying to distinguish expected control-plane/reconciliation metadata from changes that could affect application behavior, function identity, routing, authentication, secrets, or execution.

We have intentionally not modified or removed the new annotation and have paused the equivalent update on the second service pending clarification.

Thanks.