如何从Cloud Run/GCP的外部调用Cloud Run？

Question

我有一个简单的Spring Boot服务'say-hi'，可以在/say-hi下接收GET请求并返回'hello‘。它部署在托管云运行中。假设我不想向普通公众开放。现在我想做两件事：1。允许开发人员（我自己）访问'say-hi'2。允许云运行之外的另一个Spring Boot服务能够发出“say-hi”的呼叫

*   Trying 216.239.36.53...
*   Trying 2001:4860:4802:36::35...
* Immediate connect fail for 2001:4860:4802:36::35: Network is unreachable
*   Trying 2001:4860:4802:36::35...
* Immediate connect fail for 2001:4860:4802:36::35: Network is unreachable
*   Trying 2001:4860:4802:36::35...
* Immediate connect fail for 2001:4860:4802:36::35: Network is unreachable

对于我的目标2，我假设在这里有正确的会话来看待它。这是否意味着，如果我想从Cloud Run manged外部访问“say-hi”（无论是从我自己的笔记本电脑还是从其他GKE实例），我需要为我的项目启用IAP？如果是，如何将云运行与IAP集成？

Answer 1

经过一整天的搜索和阅读。最后得到一个工作版本。Google Cloud Run给出的服务到服务身份验证文档真的误导了我对IAP的看法，这里的代码留下了一些不清楚的地方。原来调用云运行服务，我根本不需要IAP。非常感谢这个博客，我从那里获得了解决方案。

  @PostMapping(value="/call-say-hi")
  public ResponseEntity<String> callSayHi() throws URISyntaxException, IOException {

    ServiceAccountCredentials serviceAccountCredentials =
        ServiceAccountCredentials.fromStream(new FileInputStream(SERVICE_ACCOUNT_JSON_KEY_PATH));
    serviceAccountCredentials.createScoped(IAM_SCOPE);
    IdTokenCredentials idTokenCredentials = IdTokenCredentials.newBuilder()
                                            .setIdTokenProvider(serviceAccountCredentials)
                                            .setTargetAudience(TARGET_AUDIENCE)
                                            .build();
    GenericUrl genericUrl = new GenericUrl(TARGET_AUDIENCE+"/say-hi");
    HttpCredentialsAdapter adapter = new HttpCredentialsAdapter(idTokenCredentials);
    HttpRequest request = httpTransport.createRequestFactory(adapter).buildGetRequest(genericUrl);
    request.setThrowExceptionOnExecuteError(false);
    HttpResponse response = request.execute();
    String r = response.parseAsString();
    System.out.println(r);
    return ResponseEntity.status(HttpStatus.OK).body(r);
  }

其中target_diudiates是部署的云运行服务URL