google-cloud-platform - 在公共 Cloud Run 服务上使用 Pub/Sub

Question

根据 Cloud Run 的“ Authenticating service-to-service ”文档，要在服务上使用Pub/Sub和Cloud Scheduler，必须禁用未经身份验证的访问，因为它们依赖 HTTP 调用，因为 Cloud Run 服务的零扩展能力。

我的服务允许内部和负载均衡器流量，并且必须对前端客户端公开可用，但它们还必须能够通过 Pub/Sub 私下相互通信。

有没有办法做到这一点？为使用 Pub/Sub 创建单独的私有服务感觉不自然。

标签： google-cloud-platformgoogle-cloud-pubsubgoogle-cloud-rungoogle-cloud-scheduler

Answer 1

It's a missing piece. You can't plug in your VPC PubSub push subscription and Cloud Scheduler (but also Cloud Task, Cloud Build, Workflows,...). I asked Google Cloud few months ago, and it should be fixed by a new network features, soon. At least in 2021!

So, in your case, if your Cloud Run service is accessible from the public internet through a Load Balancer, you can use this public endpoint to call the path that you want on your service and thus perform the process.

If your Cloud Run in only accessible from ingress=internal, you can't for now.