A solutions architect is deploying an asynchronous background worker service to Google Cloud Run using the gcloud CLI. The microservice will receive event notifications pushed from a Cloud Pub/Sub topic. The deployment must meet two strict requirements: first, the service must be protected from public unauthenticated access so only the authorized Cloud Pub/Sub push subscription service account can invoke it; second, at least two instance replicas must be kept continuously provisioned to eliminate cold-start latency for urgent events. Which TWO configuration options or flags must be specified during deployment to achieve this operational setup?
- Include the --no-allow-unauthenticated flag during gcloud run deploy to block public access and require IAM authentication.Cevap
- Include the --min-instances=2 flag during gcloud run deploy to maintain a baseline of warm container instances.Cevap
- CInclude the --port=80 flag and modify the container binary to bind directly to port 80 rather than using the PORT environment variable.
- DRe-architect the workload to use Cloud Functions (1st gen) via gcloud functions deploy because Cloud Run cannot accept Pub/Sub push POST webhooks.
Cevap
The correct requirements are achieved by specifying the '--no-allow-unauthenticated' flag to enforce IAM invoker permissions and setting '--min-instances=2' to keep warm container instances active.
To secure Cloud Run services so that only authorized GCP components (like Pub/Sub push subscriptions with OIDC tokens) can invoke them, the deployment must enforce authentication using '--no-allow-unauthenticated'. To prevent cold starts and maintain low response latency, setting '--min-instances=2' keeps two container instances booted and ready in memory.
Adım Adım Çözüm
Anahtar Kavram
Cloud Run deployment flags for IAM access control and minimum instance scaling
Tahmini Süre:1m 30s