PROFESSIONAL-CLOUD-DEVELOPER · Question #285
You manage a system that runs on stateless Compute Engine VMs and Cloud Run instances. Cloud Run is connected to a VPC, and the ingress setting is set to Internal. You want to schedule tasks on Cloud
The correct answer is D. Use Cloud Scheduler with Pub/Sub to invoke Cloud Run.. When Cloud Run ingress is set to 'Internal,' it only accepts traffic from within the connected VPC or from trusted Google services like Pub/Sub push subscriptions. Cloud Scheduler making a direct HTTP request to the Cloud Run URL uses external Google infrastructure, which is bloc
Question
You manage a system that runs on stateless Compute Engine VMs and Cloud Run instances. Cloud Run is connected to a VPC, and the ingress setting is set to Internal. You want to schedule tasks on Cloud Run. You create a service account and grant it the roles/run.invoker Identity and Access Management (IAM) role. When you create a schedule and test it, a 403 Permission Denied error is returned in Cloud Logging. What should you do?
Options
- AGrant the service account the roles/run.developer IAM role.
- BConfigure a cron job on the Compute Engine VMs to trigger Cloud Run on schedule.
- CChange the Cloud Run ingress setting to 'Internal and Cloud Load Balancing.'
- DUse Cloud Scheduler with Pub/Sub to invoke Cloud Run.
How the community answered
(26 responses)- A15% (4)
- B8% (2)
- C4% (1)
- D73% (19)
Explanation
When Cloud Run ingress is set to 'Internal,' it only accepts traffic from within the connected VPC or from trusted Google services like Pub/Sub push subscriptions. Cloud Scheduler making a direct HTTP request to the Cloud Run URL uses external Google infrastructure, which is blocked by the Internal ingress setting - hence the 403. The solution is to have Cloud Scheduler publish a message to a Pub/Sub topic, and configure a Pub/Sub push subscription targeting the Cloud Run service. Pub/Sub push delivery to Cloud Run is treated as internal traffic and bypasses the ingress restriction. Option A (roles/run.developer) would not resolve a network-level block. Option C changes ingress to allow Load Balancing traffic, which is broader than necessary. Option B introduces unnecessary VM-level complexity.
Topics
Community Discussion
No community discussion yet for this question.