Frontend proxying using Nginx

Console

1. Go to the Secret Manager page of the Google Cloud console:

   Go to Secret Manager

2. Click Create secret.

3. In the name form field, enter nginx_config.

4. Upload the nginx.conf file located at multi-container/hello-nginx-sample/nginx.conf as the secret value.

5. Keep the defaults (Google-managed encryption key, etc).

6. Click Create secret.

7. Grant the project compute service account access to this new secret. To do this, go to the IAM page in the Google Cloud console:

   Go to IAM

8. Locate the principal service account with name: Compute Engine default service account and click Edit principal.

9. Click Add another role and select Secret Manager Secret Accessor.

10. Click Save.

gcloud

1. In a terminal, use the following command to create a new nginx_config secret in Secret Manager:

   gcloud secrets create nginx_config --replication-policy='automatic' --data-file='./nginx.conf'

2. Grant the project compute service account access to this new secret using the command

   export PROJECT_NUMBER=$(gcloud projects describe $(gcloud config get-value project) --format='value(projectNumber)')
   gcloud secrets add-iam-policy-binding nginx_config --member=serviceAccount:$PROJECT_NUMBER[email protected] --role='roles/secretmanager.secretAccessor'

3. Verify that your secret was created by running gcloud secrets list.

Console

Navigate to Deploy the service for the full console instructions.

YAML

1. If you are creating a new service, skip this step. If you are updating an existing service, download its YAML configuration:

   gcloud run services describe SERVICE --format export > service.yaml

2. In service.yaml, add the following:

   metadata:
     name: "MC_SERVICE_NAME"
     labels:
       cloud.googleapis.com/location: "REGION"
     annotations:
       # Required to use Cloud Run multi-containers (preview feature)
       run.googleapis.com/launch-stage: BETA
       run.googleapis.com/description: sample tutorial service
       # Externally available
       run.googleapis.com/ingress: all

The section describes the revision of the service, which includes properties that could vary from revision to revision.

Console

Navigate to Deploy the service for the full console instructions.

YAML

In service.yaml, append the following:

spec:
  template:
    metadata:
      annotations:
        # Defines container startup order within multi-container service.
        # Below requires hello container to spin up before nginx container,
        # which depends on the hello container.
        # https://cloud.google.com/run/docs/configuring/containers#container-ordering
        run.googleapis.com/container-dependencies: "{nginx: [hello]}"

Note the container-dependencies annotation that tells Cloud Run to wait for the hello container to start up before starting the nginx container. Otherwise, if the nginx container starts first, it could try to proxy a web request to the web app container that isn't ready, which would generate web error responses.

Each container can optionally have a name property defined for it, that can be used to refer to it in other directives. The serving container runs the proxy server, named nginx. This is the container that Cloud Run delivers incoming requests to so you must specify the version of HTTP and container port to deliver them to.

Console

Navigate to Deploy the service for the full console instructions.

YAML

In service.yaml file, append the following:

spec:
  containers:
    # A) Serving ingress container "nginx" listening at PORT 8080
    # Main entrypoint of multi-container service.
    # Source is stored in nginx_config secret in Secret Manager.
    # Any pings to this container will proxy over to hello container at PORT 8888.
    # https://cloud.google.com/run/docs/container-contract#port
    - image: nginx
      name: nginx
      ports:
        - name: http1
          containerPort: 8080
      resources:
        limits:
          cpu: 500m
          memory: 256Mi
      # Referencing declared volume below,
      # Declaring volume to mount in current ingress container's filesystem
      # https://cloud.google.com/run/docs/reference/rest/v2/Container#volumemount
      volumeMounts:
        - name: nginx-conf-secret
          readOnly: true
          mountPath: /etc/nginx/conf.d/
      startupProbe:
        timeoutSeconds: 240
        periodSeconds: 240
        failureThreshold: 1
        tcpSocket:
          port: 8080

The nginx server requires a configuration file in the /etc/nginx/conf.d/ directory. To do this, mount a volume containing the file at that location. The volumeMount section specifies a volume called configuration to be placed there. The volume itself is defined in its own section later in the file.

Console

Navigate to Deploy the service for the full console instructions.

YAML

In service.yaml, append the following:

- image: us-docker.pkg.dev/cloudrun/container/hello
  name: hello
  env:
    - name: PORT
      value: "8888"
  resources:
    limits:
      cpu: 1000m
      memory: 512Mi
  startupProbe:
    timeoutSeconds: 240
    periodSeconds: 240
    failureThreshold: 1
    tcpSocket:
      port: 8888

The hello application also needs configuration information. It listens for incoming requests at the port specified in the PORT environment variable. That name and value are specified in the env section.

Console

Navigate to Deploy the service for the full console instructions.

YAML

In service.yaml file, append the following:

volumes:
  - name: nginx-conf-secret
    secret:
      secretName: nginx_config
      items:
        - key: latest
          path: default.conf

Specify the configuration volume mounted in the volumeMount section. It contains a single file called nginx.conf whose contents are defined as the value of the secret named nginx-conf-secret.

Console

1. Go to the Cloud Run page in the Google Cloud console:

   Go to Cloud Run

2. Click Deploy container and select Service to display the Create service form.

   1. Select Deploy one revision from an existing container image and enter nginx as Container image URL.
   2. In the Service name field, supply a name for your service, for example, hello-mc.
   3. From the Region list, select a location to deploy to, for example, us-west1.
   4. Under Authentication, select Allow unauthenticated invocations. If you don't have permissions (Cloud Run Admin role) to select this, the service will deploy and require authentication.

3. Click Container(s), volumes, networking, security to expand the configuration form.

   1. Click the Volumes tab.
   2. Click Add volume.
   3. From the Volume type list, select Secret.
   4. In the Volume name field, enter nginx-conf-secret.
   5. In the Secret field, enter nginx_config.
   6. Under Specified paths for secret versions, specify default.conf as the path and latest as the version.
   7. Click Create to create the secret volume.

4. Click the Containers tab to display the Edit container form.

   1. Click Settings, then under Resources, change memory to 256MiB and CPU to 1 CPU.
   2. Click Volume mounts.
   3. Click Mount volume.
   4. Select nginx-conf-secret from the name list.
   5. For Mount path, enter etc/nginx/conf.d.
   6. Click Done to complete configuration for the first container.

5. Click Add container to add the sidecar container and display the New container form.

   1. Select the default container image URL us-docker.pkg.dev/cloudrun/container/hello
   2. Click the Settings tab, then under Resources, change memory to 256MiB and CPU to 1 CPU.
   3. Click Variables & Secrets.
   4. Click Add variable.
   5. Enter PORT as the new environment variable name and 8888 as the value.
   6. Click Done.

6. Navigate to the Edit container form for the first container (nginx).

   1. Click the Settings tab.
   2. Under Container start up order, select nginx from the Depends on list. This means the nginx container starts up only after the hello container starts up successfully.
   3. Click Create and wait for your service to deploy.

gcloud

To deploy the proxy server container and web app container as a single service:

gcloud run services replace service.yaml

gcloud

To verify successful deployment, copy the generated Cloud Run URL and open it in a browser, or use this command to send an authenticated request:

curl --header "Authorization: Bearer $(gcloud auth print-identity-token)" 

You should be greeted with a nginx proxy that has successfully ported to the hello sidecar container with response status 200.

gcloud

1. In a terminal, clone the sample app repository to your local machine:

   git clone https://github.com/GoogleCloudPlatform/cloud-run-samples

2. Change to the directory that contains the Cloud Run sample code:

   cd cloud-run-samples/multi-container/hello-nginx-sample/