Restricting ingress for Cloud Run

This page describes how to use ingress settings to restrict network access to your Cloud Run service. At a network level, by default, any resource on the internet is able to reach your Cloud Run service on its run.app URL or at a custom domain set up in Cloud Run. You can change this default by specifying a different setting for ingress. All ingress paths, including the default run.app URL, are subject to your ingress setting. Ingress is set at the service level.

Ingress settings and IAM authentication methods are two ways of managing access to a service. They are independent of each other. For a layered approach to managing access, use both.

Available ingress settings

The following settings are available:

Setting Description
Internal Most restrictive. Allows requests from the following sources:
  • Internal Application Load Balancer, including requests from Shared VPC networks when routed through the internal Application Load Balancer
  • Resources allowed by any VPC Service Controls perimeter that contains your Cloud Run service. Cloud Run must be configured as a restricted service.
  • VPC networks that are in the same project as your Cloud Run service
  • Shared VPC ingress: The Shared VPC network that your revision is configured to send traffic to. For information about when Shared VPC traffic is recognized as "internal", see Special considerations for Shared VPC.
  • The following Google Cloud products, if they're in the same project or VPC Service Controls perimeter as your Cloud Run service and if they're using the default run.app URL and not a custom domain:
  • Internal Application Load Balancer, including requests from Shared VPC networks when routed through the internal Application Load Balancer.
  • Requests allowed by VPC Service Controls.

Requests from these sources stay within the Google network, even if they access your service at the run.app URL. Requests from other sources, including the internet, cannot reach your service at the run.app URL or custom domains.

For requests from Cloud Scheduler, Cloud Tasks, Eventarc, Pub/Sub, BigQuery, and Workflows to an internal service, you must use the Cloud Run default run.app URL for that service. You cannot use a custom domain.
Internal and Cloud Load Balancing This setting allows requests from the following resources:
  • Resources allowed by the more restrictive "internal" setting
  • External Application Load Balancer
Use this setting to do the following:
  • Accept requests from the internet through the external Application Load Balancer. Direct requests to the run.app URL from the internet are not allowed.
  • Ensure that requests from the internet are subject to external Application Load Balancer features, such as Identity-Aware Proxy, Google Cloud Armor, and Cloud CDN.

Note: To enable this setting in the gcloud CLI, use internal-and-cloud-load-balancing. To enable this setting in the Google Cloud console, select Internal > Allow traffic from external Application Load Balancers.
All Least restrictive. Allows all requests, including requests directly from the internet to the run.app URL.

Accessing internal services

The following additional considerations apply:

  • When accessing internal services, call them as you would normally do using their public URLs, either the default run.app URL or a custom domain set up in Cloud Run.

  • For requests from Compute Engine VM instances, no further setup is required for machines that have external IP addresses or that use Cloud NAT. Otherwise, see Receive requests from VPC networks.

  • When calling from Cloud Run, App Engine, or Cloud Functions to a Cloud Run service that's set to "Internal" or "Internal and Cloud Load Balancing", traffic must route through a VPC network that's considered internal. See Receive requests from other Cloud Run services, App Engine, and Cloud Functions.

  • Requests from resources within VPC networks in the same project are "internal" even if the resource that they originate from has an external IP address.

  • Requests from on-premises resources connected to the VPC network using Cloud VPN and Cloud Interconnect are "internal."

Setting ingress

You can set ingress using any of the supported methods in the tabs:

Console

  1. Go to Cloud Run

  2. If you are configuring a new service, click Create service and fill out the initial service settings page as desired.

  3. If you are configuring an existing service, click the service, and then click the Networking tab.

  4. Select the ingress traffic you want to allow:

    image

  5. Click Create or Save.

Command line

  1. If you are deploying a new service, deploy your service with the --ingress flag:

    gcloud run deploy SERVICE --image IMAGE_URL --ingress INGRESS

    Replace

    • INGRESS with one of the available ingress settings:
      • all
      • internal
      • internal-and-cloud-load-balancing
    • SERVICE with your service name
    • IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL has the shape LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG

  2. If you are changing an existing service ingress:

    gcloud run services update SERVICE --ingress INGRESS

    Replace

    • INGRESS with one of the available ingress settings:
      • all
      • internal
      • internal-and-cloud-load-balancing
    • SERVICE with your service name

YAML

  1. If you are creating a new service, skip this step. If you are updating an existing service, download its YAML configuration:

    gcloud run services describe SERVICE --format export > service.yaml

  2. Update the run.googleapis.com/ingress: annotation:

    apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  annotations:
    run.googleapis.com/ingress: INGRESS
  name: SERVICE
spec:
  template:
    metadata:
      name: REVISION

    Replace

    • SERVICE with the name of your Cloud Run
    • INGRESS with one of the available ingress settings:
      • all
      • internal
      • internal-and-cloud-load-balancing
    • REVISION with a new revision name or delete it (if present). If you supply a new revision name, it must meet the following criteria:
      • Starts with SERVICE-
      • Contains only lowercase letters, numbers and -
      • Does not end with a -
      • Does not exceed 63 characters

  3. Replace the service with its new configuration using the following command:

    gcloud run services replace service.yaml

Terraform

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

Add the following to your main.tf file:

resource "google_cloud_run_v2_service" "default" {
  provider = google-beta
  name     = "ingress-service"
  location = "us-central1"

  # For valid annotation values and descriptions, see
  # https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service#ingress
  ingress = "INGRESS_TRAFFIC_INTERNAL_ONLY"

  template {
    containers {
      image = "us-docker.pkg.dev/cloudrun/container/hello" #public image for your service
    }
  }
}

What's next