Calling a Google Cloud function from an Apigee reverse proxy in the same project

[mark_jones_ebm]

Hi,

We're new to Apigee and we're just trying to test out how we simply want to point a reverse proxy to my target Google Cloud Function).  It can't reach my target even though it is in the same project.

I have seen another thread on this but it was not answered.  Can somebody help please?

Many thanks in advance! 

[ssvaidyanathan]

@mark_jones_ebm 

Few clarifying questions:

1. Is the Cloud Function v1 or v2?
2. How is your Cloud Function exposed? Is it public or internal?

If you are using v1 and your Cloud Function is public, then you can control access to it using IAM. With service accounts, you can control the calls to Cloud Function. Here is a sample of Apigee integrating with Cloud Function that is protected using IAM (service accounts). Apigee performs Google Auth using the service account (impersonation) and hits the Cloud Function.

[mark_jones_ebm]

Hi,

If you mean gen 1 or gen 2 cloud functions, we are using gen 2.  We can switch to gen 1 if it makes things easier?

Thanks

[ssvaidyanathan]

Yeah sorry - I meant to ask if it was Gen 1 or Gen 2 🙂

[mark_jones_ebm]

Also important to stress that Apigee and the cloud functions are in the same project (if relevant).

[ssvaidyanathan]

Since its Gen 2, its powered by Cloud Run. You can provision an Internal Load Balancer and use a Serverless NEG as the backend. The NEG will be pointing to the Cloud Run service you deployed (Cloud Function Gen 2). Once thats done, the Internal Load Balancer is now part of the same peered network as Apigee, so it should be able to talk to it directly using Internal IPs.

Something like the diagram below

The other option is to basically have the function expose over internet and control access using IAM and have Apigee do the impersonation while hitting it. Like the sample here

[Hilda_Arteaga]

Hey @ssvaidyanathan thanks for your assistance on helping covering these questions

We hope you find the information helpful @mark_jones_ebm. Remember you can provdie a Like or mark an aswer as "Solved" to help others to better identify key information

[stdedwin]

So  is Apigee unable to call directly the Cloud function gen2 even if both components are in the same project?

[ssvaidyanathan]

You can if you can expose the function using an Internal Load Balancer (with Serverless NEG as the backend to the cloud function)