Restrict network ingress for Cloud Run

Console

1. In the Google Cloud console, go to the Cloud Run page:

   Go to Cloud Run

2. If you are configuring a new service, click Deploy container and select Service to display the Create service form. Fill out the initial service settings page.

3. If you are configuring an existing service, click the service, and then click the Networking tab.

4. Select the ingress traffic you want to allow:

   

5. Click Create or Save.

gcloud

1. If you are deploying a new service, deploy your service with the --ingress flag:

   gcloud run deploy SERVICE --image IMAGE_URL --ingress INGRESS

   Replace

   • INGRESS with one of the available ingress settings:
     • all
     • internal
     • internal-and-cloud-load-balancing
   • SERVICE with your service name
   • IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL has the shape LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG

2. If you are changing an existing service ingress:

   gcloud run services update SERVICE --ingress INGRESS

   Replace

   • INGRESS with one of the available ingress settings:
     • all
     • internal
     • internal-and-cloud-load-balancing
   • SERVICE with your service name

YAML

1. If you are creating a new service, skip this step. If you are updating an existing service, download its YAML configuration:

   gcloud run services describe SERVICE --format export > service.yaml

2. Update the run.googleapis.com/ingress: annotation:

   apiVersion: serving.knative.dev/v1
   kind: Service
   metadata:
     annotations:
       run.googleapis.com/ingress: INGRESS
     name: SERVICE
   spec:
     template:
       metadata:
         name: REVISION

   Replace

   • SERVICE with the name of your Cloud Run
   • INGRESS with one of the available ingress settings:
     • all
     • internal
     • internal-and-cloud-load-balancing
   • REVISION with a new revision name or delete it (if present). If you supply a new revision name, it must meet the following criteria:
     • Starts with SERVICE-
     • Contains only lowercase letters, numbers and -
     • Does not end with a -
     • Does not exceed 63 characters

3. Replace the service with its new configuration using the following command:

   gcloud run services replace service.yaml

Terraform

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

Add the following to your main.tf file:

resource "google_cloud_run_v2_service" "default" {
  provider = google-beta
  name     = "ingress-service"
  location = "us-central1"

  deletion_protection = false # set to "true" in production

  # For valid annotation values and descriptions, see
  # https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service#ingress
  ingress = "INGRESS_TRAFFIC_INTERNAL_ONLY"

  template {
    containers {
      image = "us-docker.pkg.dev/cloudrun/container/hello" #public image for your service
    }
  }
}

Command line

• To disable the run.app URL for a service, run the gcloud beta run deploy or gcloud beta run services update command with the --no-default-url flag:

  gcloud beta run deploy SERVICE_NAME --no-default-url
  

  where SERVICE_NAME is the name of your Cloud Run service.

In the output, the URL displays as None.

To restore the default URL, use the --default-url flag.

YAML

1. If you are creating a new service, skip this step. If you are updating an existing service, download its YAML configuration:

   gcloud run services describe SERVICE --format export > service.yaml

2. To disable the run.app URL, use the run.googleapis.com/default-url-disabled annotation:

   apiVersion: serving.knative.dev/v1
   kind: Service
   metadata:
     annotations:
       run.googleapis.com/default-url-disabled: true
       run.googleapis.com/launch-stage: BETA
     name: SERVICE
   spec:
     template:
       metadata:
         name: REVISION

   Replace

   • SERVICE with the name of your Cloud Run service.
   • REVISION with a new revision name or delete it (if present). If you supply a new revision name, it must meet the following criteria:
     • Starts with SERVICE-
     • Contains only lowercase letters, numbers and -
     • Does not end with a -
     • Does not exceed 63 characters

3. Create or update the service using the following command:

   gcloud run services replace service.yaml

To restore the default URL, remove the run.googleapis.com/default-url-disabled annotation.