I thought because both services are from google and in the same project, there would not be such a problem. I didn't set any API key or policy on apigee yet.
What is SERVICE_URL ? is that the direct link to the cloudrun service? Or is it the link to the Apigee facade for the service?
Also, your assumption about "both services are from google and are in the same project" is not valid. The tutorial I linked gives instructions for how to connect Apigee to a cloud run service.
It still doesn't work and the documentation is not synced with the current UI! I watch many videos but all have a different UI. I don't know why they changed it so quickly :))
I get what you're saying. I'm sorry about that. All of that sounds frustrating. You make a good point - when the documentation and videos are not current with the actual UI, it's not a good thing.
Let me explain what I have and what I want then.
ok thanks for that explanation, very clear. And I think you're on the right track, trying to separate the concern of "API Key validation" out of your own code. Apigee can do that, and once you coordinate a few things (configuring the API Product, the developer, and the app), it is pretty straightforward.
But It sounds like, for you, even getting the VerifyAPIKey policy set up in Apigee has been a challenge. This video shows how to do it, using the prior UI ! 😞 I don't know if there's a video that shows how to do that, in the current UI. That's a shame. I'll see if I can find or make one. Here's a quick video I just recorded showing how to do this in the new Cloud Console UI.
What you may want to do is decompose the problem . One problem is getting Apigee to verify an API key. Another problem is connecting an Apigee proxy to cloudrun. A suggestion maybe? Solve them independently and then merge them. The tutorial I showed covers the latter problem. The video I just cited covers the first problem. Remember, you can create a "loopback" proxy in Apigee that doesn't connect to any backend, to work out things like API Key verification. Then modify that proxy to connect to a target (like cloud run).
The key to connecting Apigee to a Cloud Run service is :
- In the Apigee Proxy, in the TargetEndpoint, Use the Authentication in the HTTPTargetEndpoint configuration. Within that, specify GoogleAccessToken. (explained here)
- When you deploy the proxy, attach a particular service account, which has CloudRunInvoker role (explained in same doc cited above)
- To do this, the USER or principal that deploys the API proxy must have "actAs" permission on that serviceaccount. (same)
Related to that "actAs" requirement, I think doing this:
curl -H "Authorization: Bearer $(gcloud auth print-identity-token)" "$CLOUD_RUN_SERVICE_URL"
... will not simulate the connection from Apigee to Cloud Run. For the command you tried, the token that will be injected into the Authorization header here is an identity token, not an access token. And it identifies YOU, not the service account. I think you want to present an Access token, not an identity token, and I think you want that access token to be generated for the ServiceAccount, not for you. To get a token like that, you can use something like this:
gcloud auth print-access-token --impersonate-service-account=PRIV_SA
(source)
Therefore the sequence to sort of "simulate" what Apigee will do to connect to a Cloud Run service, is like this:
TOKEN=$(gcloud auth print-access-token --impersonate-service-account=PRIV_SA)
curl -i -H "Authorization: Bearer $TOKEN" $URL_FOR_CLOUD_RUN_SERVICE
And here, again, you need "actAs" permission on that PRIV_SA. In other words, You need permissions to impersonate the ServiceAccount. This is the same permission you would need if you deployed the Apigee proxy , attaching that service account. The Tutorial I cited in my prior reply shows the gcloud commands to make this all happen.
LinkedIn
Twitter
