Soru

Zorluk: OrtaDeploying Serverless Applications with Cloud Run and Cloud Functions

A solutions architect is deploying an asynchronous background worker service to Google Cloud Run using the gcloud CLI. The microservice will receive event notifications pushed from a Cloud Pub/Sub topic. The deployment must meet two strict requirements: first, the service must be protected from public unauthenticated access so only the authorized Cloud Pub/Sub push subscription service account can invoke it; second, at least two instance replicas must be kept continuously provisioned to eliminate cold-start latency for urgent events. Which TWO configuration options or flags must be specified during deployment to achieve this operational setup?

  1. Include the --no-allow-unauthenticated flag during gcloud run deploy to block public access and require IAM authentication.Cevap
  2. Include the --min-instances=2 flag during gcloud run deploy to maintain a baseline of warm container instances.Cevap
  3. C
    Include the --port=80 flag and modify the container binary to bind directly to port 80 rather than using the PORT environment variable.
  4. D
    Re-architect the workload to use Cloud Functions (1st gen) via gcloud functions deploy because Cloud Run cannot accept Pub/Sub push POST webhooks.

Cevap

The correct requirements are achieved by specifying the '--no-allow-unauthenticated' flag to enforce IAM invoker permissions and setting '--min-instances=2' to keep warm container instances active.
To secure Cloud Run services so that only authorized GCP components (like Pub/Sub push subscriptions with OIDC tokens) can invoke them, the deployment must enforce authentication using '--no-allow-unauthenticated'. To prevent cold starts and maintain low response latency, setting '--min-instances=2' keeps two container instances booted and ready in memory.

Adım Adım Çözüm

1
Configure security settings for Cloud Run ingress
Using '--no-allow-unauthenticated' ensures that unauthenticated internet traffic is rejected with an HTTP 401/403 error, allowing only authenticated callers such as Pub/Sub push service accounts.
By default, services deployed via gcloud run deploy may prompt for public access or default to private depending on organization policies; explicitly passing '--no-allow-unauthenticated' guarantees private access.
2
Configure instance provisioning for latency optimization
Setting '--min-instances=2' guarantees 2 instances remain initialized even when there is zero active incoming traffic.
This eliminates cold starts for time-sensitive background events pushed by Cloud Pub/Sub.

Anahtar Kavram

Cloud Run deployment flags for IAM access control and minimum instance scaling
Tahmini Süre:1m 30s
Bu soruyu puanla