Praktik terbaik: Menjalankan tugas terjadwal di perimeter Kontrol Layanan VPC
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan praktik terbaik untuk menjalankan tugas Cloud Run terjadwal
untuk project Google Cloud saat menggunakan perimeter Kontrol Layanan VPC.
Cloud Scheduler tidak dapat memicu tugas di dalam perimeter Kontrol Layanan VPC. Anda harus melakukan langkah tambahan untuk
menyiapkan tugas terjadwal. Secara khusus, Anda harus melakukan proxy permintaan melalui komponen lain. Sebaiknya gunakan layanan Cloud Run sebagai proxy.
Diagram berikut menunjukkan arsitekturnya:
Sebelum memulai
Menyiapkan Cloud Run untuk Kontrol Layanan VPC. Ini adalah penyiapan satu kali yang digunakan oleh semua
tugas terjadwal berikutnya. Anda juga harus melakukan beberapa penyiapan per layanan nanti,
yang dijelaskan dalam petunjuk berikut.
Menyiapkan tugas terjadwal
Untuk menyiapkan tugas terjadwal di dalam perimeter Kontrol Layanan VPC:
Jika Anda tidak memiliki tugas Cloud Run yang ingin dipicu,
uji fitur ini dengan men-deploy sampel container tugas Cloud Run us-docker.pkg.dev/cloudrun/container/job:latest ke Cloud Run.
Deploy layanan Cloud Run yang bertindak sebagai proxy. Lihat Contoh layanan proxy untuk contoh layanan yang memicu tugas Cloud Run sebagai respons terhadap permintaan.
Setelah deployment, konsol akan menampilkan URL layanan di samping teks URL:.
Selesaikan penyiapan Kontrol Layanan VPC khusus Cloud Run per layanan. Anda perlu menghubungkan layanan ke jaringan VPC, dan merutekan semua traffic melalui jaringan tersebut. Pastikan untuk menetapkan ingress ke Internal.
Buat tugas cron Cloud Scheduler yang memicu layanan proxy Cloud Run Anda:
Untuk URL, masukkan URL layanan proxy Cloud Run yang Anda catat di langkah sebelumnya.
Untuk metode HTTP, pilih Get.
Untuk header Auth, pilih Tambahkan token OIDC
Untuk Akun Layanan, pilih Akun layanan default Compute Engine atau akun layanan kustom yang memiliki izin run.routes.invoke atau peran Cloud Run Invoker.
Untuk Audiens, masukkan URL layanan proxy Cloud Run yang sama dengan yang Anda catat di langkah sebelumnya.
Biarkan kolom lain kosong.
Klik Buat untuk membuat tugas cron Cloud Scheduler.
Contoh layanan proxy
Bagian berikut menunjukkan contoh layanan python yang melakukan proxy permintaan dan
memicu tugas Cloud Run.
Buat file bernama main.py lalu tempelkan kode berikut ke dalamnya. Perbarui nama tugas, region, dan project ID ke nilai yang Anda perlukan.
importos
fromflaskimportFlask
app=Flask(__name__)# pip install google-cloud-run
fromgoogle.cloudimportrun_v2
@app.route('/')
defhello():
client=run_v2.JobsClient()# UPDATE TO YOUR JOB NAME, REGION, AND PROJECT IDjob_name='projects/YOUR_PROJECT_ID/locations/YOUR_JOB_REGION/jobs/YOUR_JOB_NAME'print("Triggering job...")request=run_v2.RunJobRequest(name=job_name)operation=client.run_job(request=request)response=operation.result()print(response)return"Done!"if__name__=='__main__':
app.run(debug=True,host="0.0.0.0",port=int(os.environ.get("PORT",8080)))
Buat file bernama requirements.txt lalu tempelkan kode berikut ke dalamnya:
Build dan deploy container. Deployment berbasis sumber dapat menjadi tantangan
untuk disiapkan di lingkungan Kontrol Layanan VPC, karena perlunya menyiapkan pekerja kustom Cloud Build. Jika Anda sudah memiliki pipeline build dan deployment, gunakan pipeline tersebut untuk mem-build kode sumber ke dalam container dan men-deploy container sebagai layanan Cloud Run.
Jika Anda tidak memiliki penyiapan build dan deployment yang ada, build penampung secara lokal dan kirimkan ke Artifact Registry, misalnya:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[],[],null,["# Best practices: Execute scheduled jobs in a VPC Service Controls perimeter\n\nThis page describes best practices for executing scheduled Cloud Run\njobs for Google Cloud projects when using a VPC Service Controls perimeter.\n\nCloud Scheduler cannot trigger jobs inside a VPC Service Controls perimeter. You must take additional steps to\nset up scheduled jobs. In particular, you must proxy the request through another component. We recommend using a Cloud Run service as the proxy.\n\nThe following diagram shows the architecture:\n\nBefore you begin\n----------------\n\n[Set up Cloud Run for VPC Service Controls](/run/docs/securing/using-vpc-service-controls). This is a one-time setup that all\nsubsequent scheduled jobs use. You must also do some per-service setup later,\nwhich is described in the instructions that follow.\n\nSet up a scheduled job\n----------------------\n\nTo set up a scheduled job inside a VPC Service Controls perimeter:\n\n1. [Create a job](/run/docs/create-jobs), and note the name of your job.\n\n2. Complete the per-job Cloud Run-specific [VPC Service Controls setup](/run/docs/securing/using-vpc-service-controls#deploy-compliant-services). You need to [connect your job to a VPC network](/run/docs/configuring/connecting-vpc)\n and route all traffic through that network.\n\n If you don't have an existing Cloud Run job that you want to trigger,\n test the feature by deploying the sample Cloud Run jobs container `us-docker.pkg.dev/cloudrun/container/job:latest` to Cloud Run.\n3. Deploy the Cloud Run service that acts as a proxy. See [Sample proxy service](#proxy-service) for a sample service that triggers a Cloud Run job in response to a request.\n After deployment, the console displays the service's URL next to the text **URL:**.\n\n4. Complete the per-service Cloud Run-specific VPC Service Controls [setup](/run/docs/securing/using-vpc-service-controls#deploy-compliant-services). You need to connect the service to a\n VPC network, and route all traffic through that network. Make\n sure to set ingress to *Internal*.\n\n5. Create a Cloud Scheduler cron job that triggers your Cloud Run proxy\n service:\n\n 1. [Go to the Cloud Scheduler jobs console page](https://console.cloud.google.com/cloudscheduler)\n\n 2. Click **Create Job**.\n\n 3. Enter the values you want for the **Name** , **Region** , **Frequency** , and\n **Timezone** fields. For more information, see [Create a cron job using Cloud Scheduler](/scheduler/docs/schedule-run-cron-job#create-job).\n\n 4. Click **Configure the execution**.\n\n 5. Select Target type **HTTP**.\n\n 6. For **URL**, enter the Cloud Run proxy service URL that you noted in the previous step.\n\n 7. For HTTP method, select **Get**.\n\n 8. For Auth header, select **Add OIDC token**\n\n 9. For Service Account, select **Compute Engine default service account** or a\n custom service account that has the `run.routes.invoke` permission or the\n `Cloud Run Invoker` role.\n\n 10. For Audience, enter the same enter the Cloud Run proxy service URL\n that you noted in the previous step.\n\n 11. Leave all other fields blank.\n\n 12. Click **Create** to create the Cloud Scheduler cron job.\n\nSample proxy service\n--------------------\n\nThe following section shows a sample python service that proxies requests and\ntriggers the Cloud Run job.\n\n1. Create a file called `main.py` and paste the following code into it. Update the job name, region, and project ID to the values you need.\n\n ```bash\n import os\n from flask import Flask\n app = Flask(__name__)\n\n # pip install google-cloud-run\n from google.cloud import run_v2\n\n @app.route('/')\n def hello():\n\n client = run_v2.JobsClient()\n\n # UPDATE TO YOUR JOB NAME, REGION, AND PROJECT ID\n job_name = 'projects/YOUR_PROJECT_ID/locations/YOUR_JOB_REGION/jobs/YOUR_JOB_NAME'\n\n print(\"Triggering job...\")\n request = run_v2.RunJobRequest(name=job_name)\n operation = client.run_job(request=request)\n response = operation.result()\n print(response)\n return \"Done!\"\n\n if __name__ == '__main__':\n app.run(debug=True, host=\"0.0.0.0\", port=int(os.environ.get(\"PORT\", 8080)))\n ```\n2. Create a file named `requirements.txt` and paste the following code into it:\n\n ```bash\n google-cloud-run\n flask\n ```\n3. Create a Dockerfile with the following contents:\n\n ```bash\n FROM python:3.9-slim-buster\n\n WORKDIR /app\n\n COPY requirements.txt requirements.txt\n RUN pip install --no-cache-dir -r requirements.txt\n\n COPY . .\n\n CMD [\"python3\", \"main.py\"]\n ```\n4. Build and deploy the container. Source-based deployments can be challenging\n to set up in a VPC Service Controls environment, due to the need to set up\n Cloud Build custom workers. If you have an existing build and deploy pipeline, use it to build the source code into a container and deploy the container as a Cloud Run service.\n\n If you don't have an existing build and deploy setup, build the container locally and push it to Artifact Registry, for example: \n\n ```bash\n PROJECT_ID=YOUR_PROJECT_ID\n REGION=YOUR_REGION\n AR_REPO=YOUR_AR_REPO\n CLOUD_RUN_SERVICE=job-runner-service\n\n docker build -t $CLOUD_RUN_SERVICE .\n\n docker tag $CLOUD_RUN_SERVICE $REGION_ID-docker.pkg.dev/$PROJECT_ID/AR_REPO/$CLOUD_RUN_SERVICE\n\n docker push $REGION_ID-docker.pkg.dev/$PROJECT_ID/AR_REPO/$CLOUD_RUN_SERVICE\n ```\n\n Note the service URL returned by the deploy command.\n\nWhat's next\n-----------\n\nAfter you use this feature, learn more by reading the following:\n\n- [View job logs](/run/docs/logging)\n- [Monitor job performances](/run/docs/monitoring)\n- [Create a job](/run/docs/create-jobs)\n- [Execute a job](/run/docs/execute/jobs)\n- [Manage jobs](/run/docs/managing/jobs)\n- [Manage job executions](/run/docs/managing/job-executions)\n\n- [Set memory limits](/run/docs/configuring/jobs/memory-limits)\n\n- [Set environment variables](/run/docs/configuring/jobs/environment-variables)"]]
