LinkedIn
Twitter
Hi everyone
I'd like to understand something, I'm following this article to create a PSC connection between my ApigeeX organization and my Target project which contains multiple Cloud Run services.
I successfully created the connection between the projects and when creating a new API Proxy to call a Cloud Run service it works for unauthenticated calls; nevertheless when adding authentication I got:
The URL must be ssl enabled if Authentication is present.
Please note the service account used for deployment has the serviceAccountUser role in the Apigee org project and run.invoker in the target project.
Per the documentation [1] when working with Southbound PCS targets I have to add this as a target:
<HTTPTargetConnection>
<URL>http://7.0.8.5:80</URL>
</HTTPTargetConnection>
I have tried to use:
<HTTPTargetConnection>
<URL>https://7.0.8.5:443</URL>
</HTTPTargetConnection>
But, it is not working, either.
My question is, when using this southbound PSC target how can I use :
<Authentication>
<GoogleIDToken>
<Audience useTargetUrl="true"/>
</GoogleIDToken>
</Authentication>
if my endpoint attachment IP is HTTP and not HTTPS?
I add a diagram of my current architecture
Any guidance will be appreciated.
@miguelmendoza tagged as I checked [2].
Solved
1 ACCEPTED SOLUTION
Hi @kurtkanaskie upon trying your given configuration I am still getting 504 in Apigee X
{
"fault": {
"faultstring": "Gateway Timeout",
"detail": {
"errorcode": "messaging.adaptors.http.flow.GatewayTimeout",
"reason": "TARGET_READ_TIMEOUT"
}
}
}my targetserver configuration:
{
"name": "auth-poc-ignore-ssl-ip",
"host": "7.0.24.2",
"port": 443,
"isEnabled": true,
"sSLInfo": {
"enabled": true,
"ignoreValidationErrors": true
},
"protocol": "HTTP"
}my AM configuration (actual host has been replaced):
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage continueOnError="false" enabled="true" name="AM-host-header">
<DisplayName>AM-host-header</DisplayName>
<Properties/>
<AssignVariable>
<Name>target.header.host</Name>
<Value>ilbhostname.com</Value>
</AssignVariable>
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
<AssignTo createNew="false" transport="http" type="request"/>
</AssignMessage>Assign it to targetserver preflow (actual CF v2 link has been replaced):
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<TargetEndpoint name="default">
<Description/>
<FaultRules/>
<PreFlow name="PreFlow">
<Request>
<Step>
<Name>AM-host-header</Name>
</Step>
</Request>
<Response/>
</PreFlow>
<PostFlow name="PostFlow">
<Request/>
<Response/>
</PostFlow>
<Flows/>
<HTTPTargetConnection>
<Properties/>
<LoadBalancer>
<Server name="auth-poc-ignore-ssl-ip"/>
</LoadBalancer>
<Authentication>
<GoogleIDToken>
<Audience>https://mycloudfunctionv2.cloudfunctions.net/AuthenticationPOC</Audience>
</GoogleIDToken>
</Authentication>
</HTTPTargetConnection>
</TargetEndpoint>I have also checked this document troubleshooting guide:
verified all the configuration mention are ok.
Tried calling the configured ILB on a custom created VM for testing it is working:
Also verified the ILB logs .The https call is coming when called via curl on a VM but not when called from ApigeeX.
Checking if there is still something that I can check for debugging the issue.
Hmmm, that all looks OK.
Perhaps it's firewall related?
The general steps are:
gcloud compute networks subnets create psc-subnet \
--project=$PROJECT_ID --network default --region=us-east1 \
--purpose=PRIVATE_SERVICE_CONNECT --range=10.100.0.0/28
gcloud compute firewall-rules create allow-psc-nat-443 \
--project=$PROJECT_ID --network default \
--direction=INGRESS --priority=1000 --action=ALLOW --rules=tcp:443 \
--source-ranges=10.100.0.0/28 --target-tags=psc-demo
gcloud compute service-attachments create psc-attachment \
--project=$PROJECT_ID --region=us-east1 \
--producer-forwarding-rule=fr-ilb \
--connection-preference=ACCEPT_AUTOMATIC \
--nat-subnets=psc-subnet
