Question

Your team has deployed a customer-facing API to Cloud Run in the us-central1 region. The service currently responds at its default run.app URL, but the marketing team wants it served from api.example.com with a valid TLS certificate that is automatically provisioned and renewed. You own the example.com domain and can edit its DNS records. What is the recommended way to achieve this with the least ongoing maintenance?

Accepted Answer

Create a Cloud Run domain mapping for api.example.com, verify domain ownership, and add the DNS records Cloud Run provides so Google manages the certificate automatically.

Answer

Purchase a TLS certificate from a third-party CA, upload it to Cloud Run as a secret, and mount it into the container to terminate HTTPS.

Answer

Add a CNAME record pointing api.example.com directly to the run.app URL and rely on the existing run.app certificate to cover the custom domain.

Answer

Reserve a static external IP, attach it to the Cloud Run service, and configure the certificate manually on the container's web server.