Access Cloud Run from Compute Engine in internal ingress mode

user_413306 0
Viewed 1103

We are trying to access cloud run service url from compute engine.

Cloud Run services are deployed with ingress mode as internal.

Currently its giving "Access Forbidden" status when accessing the service url.

However when ingress mode is set to all i can access but want to access it only with in google network from my compute engine.

I even added the compute service account of compute engine as member in cloud run permissions.

Any solutions for this?

Update

Project setup I have a shared vpc setup(as of now only us-central1 subnet sharing) where host project's vm try to access the cloud run url. Doing a Curl from host project's vm fails with "Access Forbidden".

However, I tried creating a temp vm in the same project where cloud run service exists. Still I see the same error from this VM too.

As per documentation, setting Internal ingress will allow any in the project to be accessed directly. But this doesn't seem to happen.

I even added roles/run.invoker role for the compute engine's service account as member in Cloud run service.

Cloud Run is using the Serverless vpc connector of the host project.

enter image description here

google-cloud-run
2 Answers

I was working on a similar thing as you, and contacted support about this problem. At first they even said that it was possible but then changed their mind and gave my the following reply:

It is true that Cloud Run is an eligible resource of a Shared VPC, however this will only work for outbound connections, this is Cloud Run calling any other resource in the Shared VPC through the VPC connector (Cloud Run -> Shared VPC -> Google Cloud Resource).

For inbound connections (for example using a GKE cluster to call a Cloud Run service with internal ingress setting enable such as GKE cluster -> Shared VPC -> Cloud Run), this is not currently possible. Nonetheless, the Cloud Run product team is working on giving services private IPs, once that is in place, internal services will be able to be called from a shared VPC using their private IPs, but until then, sadly this is not supported.

user_152756870

Hi I had a similar requirement and I could fix it by following below mentioned measure.

Resources in Shared VPC networks can only call internal services if the Shared VPC resources and the internal service are in the same VPC SC perimeter and the Cloud Run Admin API is configured as a restricted service in the service perimeter [1].

So to call the Cloud Run service from a VM in the shared VPC it is necessary to configure a service perimeter at the organization level; you can see the steps in the following documentation [2].

[1] https://cloud.google.com/run/docs/securing/ingress#internal-services

[2] https://cloud.google.com/run/docs/securing/using-vpc-service-controls#set-up-perimeter

After following the steps in [2] my VM was able to call the Cloud run service. Please note that if egress from Cloud run is not required, there is no need to set up a serverless VPC connector.

Let me know if this helped!

user_123176090
Related