Question

Your company runs an internal microservices platform. A new Cloud Run service must be reachable only from clients inside the VPC and from on-premises networks connected via HA VPN, using a private RFC 1918 IP address and a friendly internal hostname. You need to route requests to the Cloud Run service through a load balancer. Which configuration meets these requirements?

Accepted Answer

Create a regional internal Application Load Balancer with a serverless NEG backend pointing to the Cloud Run service, and enable global access on the forwarding rule if cross-region clients are needed.

Answer

Create a global external Application Load Balancer with a serverless NEG backend and restrict access using Cloud Armor allowlists for the VPC and on-premises ranges.

Answer

Create an internal passthrough Network Load Balancer with a zonal NEG backend that references the Cloud Run revision endpoints.

Answer

Create a regional external Application Load Balancer with a serverless NEG and place it behind Cloud NAT so it only receives internal traffic.