云运行服务调用

Question

I would like to know if there is a way to invoke a cloud run service with a service account from a compute engine VM without a JWT token. The idea is to restrict the cloud run service access only from the VM. The request from the VM towards the cloud run service cant have more than one token.So I cannot use the service account jwt in the request

Answer 1

Note that there is no way for you to use only one token to authorize your requests (if you plan on communicating with your Cloud Run service through periods of time):

The ID tokens are JSON Web Tokens (JWTs) that expire approximately an hour after creation. If you fetch tokens from the metadata server, you will always get a valid token.

After 1 hour, you need to use another token as the old one is no longer valid. This can be a problem if you manually generate the ID token from gcloud auth for example. You can however, simply fetch them from the metadata server programmatically (see the code samples). This is possible as any Google Cloud services can have access to the metadata server (that includes Cloud Run and Compute Engine). The tokens fetched will still expire, but the refresh is automatically done for you.

"The idea is to restrict the cloud run service access only from the VM."

If your Cloud Run service requires authorization, any user or service account without a run.routes.invoke permission won't be able to access your Cloud Run Service even if they have a valid request. This permission can be found of Cloud Run Invoker role or an IAM role with general access to Cloud Run services such as Cloud Run Admin or Editor role.

In this case, I recommend that you fetch tokens from the metadata server programmatically and then assign the Cloud Run Invoker role to the service account your Compute Engine VM is using as it is the least privilege role needed to invoke a Cloud Run service.

Answer 2

In a very special case, you can achieve what you want. You need

• To have only 1 VM (the VM that you talk about) in your VPCs of your project
• Set the Cloud Run ingress control to internal . Like this, only the component connected to your VPC will be able to call your Cloud Run service.

Because of the latest condition, you shouldn't connect anything to your VPC

• No other VMs in your project
• No external connection to the VPC (cloud VPN, interconnect, VPC Peering)
• No VPC SC
• No serverless VPC connector used by another serverless product

Because you don't want to rely on the identity (The JWT token), you need to rely on the existence in the network.