使用 TLS 从 Go 客户端进行 gRPC 调用 - GCP Cloud Function

Question

I'm working on a few different GCP Cloud Functions that need to communicate with my backend using gRPC. The backend services are encrypted behind TLS, and only accessible through it (the APIs can't be called without TLS). The server is working perfectly fine as expected, I have a UI that is also calling the same APIs, and those work perfectly fine so the server is properly set up.

Given this setup, I'm struggling to figure out how I can call my backend APIs through gRPC from my GCP Cloud Functions. I know i can call grpc.Dial("some_endpoint", grpc.WithTransportCredentials(<credentials>)) , however I don't know how to get credentials to pass to the grpc.WithTransportCredentials method.

I'm not sure what other information you may need, but whatever it may be, I will be happy to provide.

Answer 1

You can refer to this gRPC authentication mechanisms guide that provides examples on supported auth mechanisms such as SSL/TLS integration, ALTS and Token-based authentication with Google.

Sample implementation:

1. No encryption or authentication

• Client

 conn, _:= grpc.Dial("localhost:50051", grpc.WithTransportCredentials(insecure.NewCredentials())) // error handling omitted client:= pb.NewGreeterClient(conn) //...

• Server

 s:= grpc.NewServer() lis, _:=.net.Listen("tcp", "localhost:50051") // error handling omitted s.Serve(lis)

2. With server authentication SSL/TLS

• Client

 creds, _:= credentials.NewClientTLSFromFile(certFile, "") conn, _:= grpc.Dial("localhost:50051", grpc.WithTransportCredentials(creds)) // error handling omitted client:= pb.NewGreeterClient(conn) //...

• Server

 creds, _:= credentials.NewServerTLSFromFile(certFile, keyFile) s:= grpc.NewServer(grpc.Creds(creds)) lis, _:=.net.Listen("tcp", "localhost:50051") // error handling omitted s.Serve(lis)

3. Authenticate using Google service account

 pool, _:= x509.SystemCertPool() // error handling omitted creds:= credentials.NewClientTLSFromCert(pool, "") perRPC, _:= oauth.NewServiceAccountFromFile("service-account.json", scope) conn, _:= grpc.Dial( "greeter.googleapis.com", grpc.WithTransportCredentials(creds), grpc.WithPerRPCCredentials(perRPC), ) // error handling omitted client:= pb.NewGreeterClient(conn) //...