Restrict network endpoint ingress for Cloud Run services and instances

This page describes how to use ingress settings to restrict network access to your Cloud Run services and instances.

At a network level, a Cloud Run service's or instance's endpoint is reachable from the following network ingress paths:

• Default run.app URLs, which you can disable
• Any configured domain mapping
• Any configured External Application Load Balancer or Internal Application Load Balancer

All network ingress paths are subject to the resource's ingress setting. The default ingress paths and ingress setting allow any resource on the internet to reach your Cloud Run resource. You can use a custom constraint to restrict ingress settings for your organization or for a set of projects. IAM authentication still applies to requests reaching the service or instance endpoints from any of the preceding network ingress paths. For a layered approach to managing access, use both network ingress settings and IAM authentication.

Use network tags to restrict connector VM access to VPC resources.

Available network ingress settings

The following settings are available:

Setting	Description
Internal	Most restrictive. Allows requests from the following sources: Internal Application Load Balancer, including requests from Shared VPC networks when routed through the internal Application Load Balancer. Resources allowed by any VPC Service Controls perimeter that contains your Cloud Run service or instance. Cloud Run must be configured as a restricted service. VPC networks that are in the same project as your Cloud Run service or instance. Shared VPC ingress: the Shared VPC network that your service revision or Cloud Run instance is configured to send traffic to. For information about when Shared VPC traffic is recognized as "internal", see Special considerations for Shared VPC. The following Google Cloud products, if they're in the same project or VPC Service Controls perimeter as your Cloud Run service or instance, and if they're using the default run.app URL and not a custom domain: Cloud Scheduler Cloud Tasks Dialogflow CX Eventarc Pub/Sub subscriptions Synthetic monitors (including uptime checks) Workflows BigQuery Requests from these sources stay within the Google network, even if they access your service or instance at the run.app URL. Requests from other sources, including the internet, cannot reach your service or instance at the run.app URL or custom domains.
Internal and Cloud Load Balancing	This setting allows requests from the following resources: Resources allowed by the more restrictive "internal" setting External Application Load Balancer Use this setting to do the following: Accept requests from the internet through the external Application Load Balancer. Direct requests to the run.app URL from the internet are not allowed. Ensure that requests from the internet are subject to external Application Load Balancer features, such as Identity-Aware Proxy, Google Cloud Armor, and Cloud CDN. Note: To enable this setting in the gcloud CLI, use internal-and-cloud-load-balancing. To enable this setting in the Google Cloud console, select Internal > Allow traffic from external Application Load Balancers.
All	Least restrictive. Allows all requests, including requests directly from the internet to the run.app URL.

Access internal services

The following additional considerations apply:

• When accessing internal services, call them as you would normally do using their URL, either the default run.app URL or a custom domain set up in Cloud Run.

• For requests from Compute Engine VM instances, no further setup is required for machines that have external IP addresses or that use Cloud NAT. Otherwise, see Receive requests from VPC networks.

• When calling from Cloud Run or App Engine to a Cloud Run service that's set to "Internal" or "Internal and Cloud Load Balancing", traffic must route through a VPC network that's considered internal. See Receive requests from other Cloud Run services or App Engine.

• Requests from resources within VPC networks in the same project are "internal" even if the resource that they originate from has an external IP address.

• Requests from on-premises resources connected to the VPC network using Cloud VPN and Cloud Interconnect are "internal."

Set ingress

The following sections show how to set ingress for Cloud Run services and instances.

Set ingress for Cloud Run services

You can set ingress for a Cloud Run service by using the Google Cloud console, Google Cloud CLI, YAML, or Terraform.

Console

1. In the Google Cloud console, go to the Cloud Run Services page:

   Go to Cloud Run

2. If you are configuring a new service, click Deploy container to display the Create service form. Fill out the initial service settings page.

3. If you are configuring an existing service, click the service, and then click the Networking tab.

4. Select the ingress traffic you want to allow:

   

5. Click Create or Save.

gcloud

1. If you are deploying a new service, deploy your service with the --ingress flag:

   gcloud run deploy SERVICE \
       --image IMAGE_URL \
       --ingress INGRESS

   Replace the following:

   • SERVICE: your service name.
   • IMAGE_URL: a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL follows the format of LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG .
   • INGRESS: one of the available ingress settings:
     • all
     • internal
     • internal-and-cloud-load-balancing

2. If you are changing an existing service ingress:

   gcloud run services update SERVICE \
       --ingress INGRESS

   Replace the following:

   • SERVICE: your service name
   • INGRESS: one of the available ingress settings:
     • all
     • internal
     • internal-and-cloud-load-balancing

YAML

1. If you are creating a new service, skip this step. If you are updating an existing service, download its YAML configuration:

   gcloud run services describe SERVICE --format export > service.yaml

2. Update the run.googleapis.com/ingress: annotation:

   apiVersion: serving.knative.dev/v1
   kind: Service
   metadata:
     name: SERVICE
     annotations:
       run.googleapis.com/ingress: INGRESS
   spec:
     template:
       metadata:
         name: REVISION

   Replace the following:

   • SERVICE: the name of your Cloud Run service.
   • INGRESS: one of the available ingress settings:
     • all
     • internal
     • internal-and-cloud-load-balancing
   • REVISION: a new revision name or delete it (if present). If you supply a new revision name, it must meet the following criteria:
     • Starts with SERVICE-
     • Contains only lowercase letters, numbers and -
     • Does not end with a -
     • Does not exceed 63 characters

3. Replace the service with its new configuration using the following command:

   gcloud run services replace service.yaml

Terraform

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

Add the following to a google_cloud_run_v2_service resource in your Terraform configuration:

resource "google_cloud_run_v2_service" "default" {
  provider = google-beta
  name     = "ingress-service"
  location = "us-central1"

  deletion_protection = false # set to "true" in production

  # For valid annotation values and descriptions, see
  # https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service#ingress
  ingress = "INGRESS_TRAFFIC_INTERNAL_ONLY"

  template {
    containers {
      image = "us-docker.pkg.dev/cloudrun/container/hello" #public image for your service
    }
  }
}

Set ingress for Cloud Run instances

You can set ingress for a Cloud Run instance by using the Google Cloud CLI or YAML:

gcloud

1. If you are creating a new instance, deploy your instance with the --ingress flag:

   gcloud beta run instances deploy INSTANCE \
       --image IMAGE_URL \
       --ingress INGRESS

   Replace the following:

   • INSTANCE: your instance name.
   • IMAGE_URL: a reference to the container image, such as us-docker.pkg.dev/cloudrun/container/hello:latest..
   • INGRESS: one of the available ingress settings:
     • all
     • internal
     • internal-and-cloud-load-balancing

2. If you are changing an existing instance ingress:

   gcloud beta run instances update INSTANCE \
       --ingress INGRESS

   Replace the following:

   • INSTANCE: your instance name.
   • INGRESS: one of the available ingress settings:
     • all
     • internal
     • internal-and-cloud-load-balancing

YAML

1. If you are creating a new instance, skip this step. If you are updating an existing instance, download its YAML configuration:

   gcloud beta run instances describe INSTANCE --format export > instance.yaml

2. Update the run.googleapis.com/ingress: annotation:

   apiVersion: run.googleapis.com/v1
   kind: Instance
   metadata:
     name: INSTANCE
     annotations:
       run.googleapis.com/ingress: INGRESS
       run.googleapis.com/launch-stage: BETA
   spec:
     containers:
     - name: CONTAINER_NAME
       image: IMAGE_URL

   Replace the following:

   • INSTANCE: the name of your Cloud Run instance.
   • INGRESS: one of the available ingress settings:
     • all
     • internal
     • internal-and-cloud-load-balancing
   • CONTAINER_NAME: the name of the container.
   • IMAGE_URL: a reference to the container image, such as us-docker.pkg.dev/cloudrun/container/hello:latest..

3. Create or update the instance using the following command:

   gcloud beta run instances replace instance.yaml

Note: Administrators can restrict the ingress settings that developers can select by setting the run.allowedIngress organization policy.

Disable the default URL

Before you disable the default URL, be aware that the following Google Cloud services or instance use the default run.app URL to invoke Cloud Run. Disabling the default run.app URL prevents these services or instance from working as expected:

• The cloudfunctions.net URL of Cloud Functions v2 API based on the Cloud Run service.
• Cloud Scheduler
• Cloud Service Mesh
• Cloud Tasks
• Dialogflow CX
• Eventarc
• Firebase App Hosting
• Firebase Hosting
• Pub/Sub
• Synthetic monitors and uptime checks
• Workflows

Note: To use custom domain mappings, map the custom domain before you disable the run.app URL.

See the following sections show to learn how to disable the default URL for Cloud Run services and instances.

Disable the default URL for Cloud Run services

Disable the default run.app URL of a Cloud Run service or instance to only allow traffic from the service's other ingress paths: Cloud Load Balancing and any configured domain mapping.

To disable the default URL, perform the following steps by using the Google Cloud console, Google Cloud CLI, YAML, or Terraform.

Console

1. In the Google Cloud console, go to the Cloud Run Services page:

   Go to Cloud Run

2. Click an existing service.

3. Select the Networking tab.

4. In the Endpoints card, clear Enable under Default HTTPS endpoint URL.

5. Click Save.

To restore the default URL, select Enable and click Save.

gcloud

• For an existing service, run the gcloud run services update command with the --no-default-url flag, for example:

  gcloud run services update SERVICE_NAME --no-default-url

• For a new service, run the gcloud run deploy command with the --no-default-url flag, for example:

  gcloud run deploy SERVICE_NAME --no-default-url

  Replace SERVICE_NAME with the name of your Cloud Run service.

  In the output, the URL displays as None.

To restore the default URL, use the --default-url flag.

YAML

1. If you are creating a new service, skip this step. If you are updating an existing service, download its YAML configuration:

   gcloud run services describe SERVICE --format export > service.yaml

2. To disable the run.app URL, use the run.googleapis.com/default-url-disabled annotation:

   apiVersion: serving.knative.dev/v1
   kind: Service
   metadata:
     annotations:
       run.googleapis.com/default-url-disabled: true
     name: SERVICE
   spec:
     template:
       metadata:
         name: REVISION

   Replace the following:

   • SERVICE: the name of your Cloud Run service.
   • REVISION: a new revision name or delete it (if present). If you supply a new revision name, it must meet the following criteria:
     • Starts with SERVICE-
     • Contains only lowercase letters, numbers and -
     • Does not end with a -
     • Does not exceed 63 characters

3. Create or update the service using the following command:

   gcloud run services replace service.yaml

   The gcloud run services replace command defaults to using service.yaml file if present.

To restore the default URL, remove the run.googleapis.com/default-url-disabled annotation.

Terraform

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

Add the following to a google_cloud_run_v2_service resource in your Terraform configuration:

  resource "google_cloud_run_v2_service" "disable_default_url_service" {
    name     = "cloudrun-service"
    location = "europe-west1"
    default_uri_disabled = true

    template {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/hello"
      }
      annotations = {
        "run.googleapis.com/ingress" = "all"   # "all" or "internal-only"
      }

    }
  }

Verify that the launch_stage and default_uri_disabled lines are in your main.tf file. The preceding google_cloud_run_v2_service resource specifies a Cloud Run service with the default URL disabled in Preview.

To restore the default URL, remove the default_uri_disabled and launch_stage arguments.

Disable the default URL for Cloud Run instances

Disable the default run.app URL of a Cloud Run instance to only allow traffic from the instance's other ingress paths: Cloud Load Balancing and any configured domain mapping.

gcloud

• For an existing instance, run the gcloud beta run instances update command with the --no-default-url flag, for example:

  gcloud beta run instances update INSTANCE --no-default-url

• For a new instance, run the gcloud beta run instances deploy command with the --no-default-url flag, for example:

  gcloud beta run instances deploy INSTANCE \
      --image IMAGE_URL \
      --no-default-url

  Replace INSTANCE with the name of your Cloud Run instance.

  In the output, the URL displays as None.

To restore the default URL, use the --default-url flag.

YAML

1. If you are creating a new instance, skip this step. If you are updating an existing instance, download its YAML configuration:

   gcloud beta run instances describe INSTANCE --format export > instance.yaml

2. To disable the default URL, set the run.googleapis.com/default-url-disabled annotation to 'true':

   apiVersion: run.googleapis.com/v1
   kind: Instance
   metadata:
     name: INSTANCE
     annotations:
       run.googleapis.com/default-url-disabled: 'true'
       run.googleapis.com/launch-stage: BETA
   spec:
     containers:
     - name: CONTAINER_NAME
       image: IMAGE_URL

   Replace the following:

   • INSTANCE: the name of your Cloud Run instance.
   • CONTAINER_NAME: the name of the container.
   • IMAGE_URL: a reference to the container image, such as us-docker.pkg.dev/cloudrun/container/hello:latest.

3. Create or update the instance using the following command:

   gcloud beta run instances replace instance.yaml

To restore the default URL, set the run.googleapis.com/default-url-disabled annotation to false or remove it.

What's next

• Learn about egress settings.
• Set up an internal Application Load Balancer for Cloud Run.
• Set up an external Application Load Balancer with Cloud Run.
• Configure IAM authentication methods for accessing services or instances.