A DevOps engineer needs to manage an existing Cloud Run service named `inventory-api` deployed in the `us-east1` region. The engineer must route exactly 20% of incoming production traffic to a newly deployed revision tagged `v2` while keeping the remaining 80% on the prior revision. Additionally, the service must be configured so that unauthenticated public requests are blocked. Which TWO actions should the engineer perform using `gcloud` commands or IAM configurations to achieve these requirements?
- Execute `gcloud run services update-traffic inventory-api --region=us-east1 --to-tags v2=20` to allocate traffic to the tagged revision.Answer
- Execute `gcloud run services update inventory-api --region=us-east1 --no-allow-unauthenticated` to enforce authentication requirements.Answer
- CExecute `gcloud functions deploy inventory-api --region=us-east1 --traffic-split=v2=20` to manage serverless revision routing.
- DGrant the broad primitive `roles/Editor` role to calling clients at the project level to allow service invocation.
Answer
The engineer must run `gcloud run services update-traffic inventory-api --region=us-east1 --to-tags v2=20` to shift traffic and run `gcloud run services update inventory-api --region=us-east1 --no-allow-unauthenticated` to block unauthenticated requests.
To manage Cloud Run traffic splits safely, `gcloud run services update-traffic` with `--to-tags` allows fine-grained percentage routing to tagged revisions. To restrict public access, `gcloud run services update` with the `--no-allow-unauthenticated` flag removes the `allUsers` invoker binding and enforces IAM authentication.
Step-by-Step Solution
Key Concept
Cloud Run Traffic Management & IAM Access Control