How can my cloud run service call other cloud run services?
Dec 15
I have a service listening on 'https://myapp.a.run.app/dosomething', but I want to leverage the scalability features of Cloud Run, so in the controller for 'dosomething', I send off 10 requests to 'https://myapp.a.run.app/smalltask'; with my app configured to allow servicing of only one request per instance, I expect 10 instances to spin up, all do their smalltask, and return (all within the timeout period).
But I don't know how to properly authenticate the request, so those 10 requests all result in 403's. For Cloud Run services, I manually pass in a bearer token with the initial request, though I expect to add some api proxy at some point. But without said API proxy, what's the right way to send the request such that it is accepted? The app is running as a user that does have permissions to access the endpoint.
1 answer
Accepted answer · original discussion
Dec 15
Authenticating service-to-service
If your architecture is using multiple services, these services will likely need to communicate with each other.
You can use synchronous or asynchronous service-to-service communication:
For asynchronous communication, use
- Cloud Tasks for one to one asynchronous communication
- Pub/Sub for one to many asynchronous communication
- Cloud Scheduler for regularly scheduled asynchronous communication.
- Cloud Workflows for orchestration services.
For synchronous communication
One service invokes another one over HTTP using its endpoint URL. In this use case, it's a good idea to ensure that each service is only able to make requests to specific services. For instance, if you have a login service, it should be able to access the user-profiles service, but it probably shouldn't be able to access the search service.
First, you'll need to configure the receiving service to accept requests from the calling service:
- Grant the Cloud Run Invoker (
roles/run.invoker) role to the calling service identity on the receiving service. By default, this identity isPROJECT_NUMBER-compute@developer.gserviceaccount.com.
In the calling service, you'll need to:
Create a Google-signed OAuth ID token with the audience (
aud) set to the URL of the receiving service. This value must contain the schema prefix (http://orhttps://) and custom domains are currently not supported for theaudvalue.Include the ID token in an
Authorization: Bearer ID_TOKENheader. You can get this token from the metadata server, while the container is running on Cloud Run (fully managed). If the application is running outside Google Cloud, you can generate an ID token from a service account key file.
For a full guide and examples in Node/Python/Go/Java and others see: Authenticating service-to-service
0 question comments
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.