Apigee X target endpoint and Google Authentication

[ezetina]

Hi everyone

I'd like to understand something, I'm following this article to create a PSC connection between my ApigeeX organization and my Target project which contains multiple Cloud Run services.

I successfully created the connection between the projects and when creating a new API Proxy to call a Cloud Run service it works for unauthenticated calls; nevertheless when  adding authentication I got:

The URL must be ssl enabled if Authentication is present. 

Please note the service account used for deployment has the serviceAccountUser role in the Apigee org project and run.invoker in the target project.

Per the documentation [1] when working with Southbound PCS targets I have to add this as a target:

  <HTTPTargetConnection>
    <URL>http://7.0.8.5:80</URL>
  </HTTPTargetConnection>

I have tried to use:

  <HTTPTargetConnection>
    <URL>https://7.0.8.5:443</URL>
  </HTTPTargetConnection>

But, it is not working, either.

My question is, when using this southbound PSC target how  can I use :

<Authentication>
    <GoogleIDToken>
      <Audience useTargetUrl="true"/>
    </GoogleIDToken>
</Authentication>

if my endpoint attachment IP is HTTP and not HTTPS?

I add a diagram of my current architecture

Any guidance will be appreciated.

@miguelmendoza tagged as I  checked [2].

[1] https://cloud.google.com/apigee/docs/api-platform/troubleshoot/playbooks/network-configuration/conne...

[2] https://www.googlecloudcommunity.com/gc/Apigee/How-to-Load-Balance-Between-Cloud-Run-Targets-in-Apig...