Cloud Run Accessed via Serverless NEG with URL mask returns 404

[rpmatthews1]

I am in the process of deploying the Deploy a secured serverless architecture using Cloud Run  |  Cloud Architecture Center  |  Google Cl... to host several Cloud Run services behind an internal load balancer.

A single Serverless NEG has been configured using a URL mask /<service> to direct request to the appropriate Cloud Run service.

However, when attempting to make a request via the internal load balancer using the format https://internal_lb_url/cloud_run_service a 404 error is returned.

When reviewing the logs for the Cloud Run service, we can see the 404 error recorded, which proves the ilb is forwarding the request to the correct Cloud Run service.

If the URL mask is removed and the Serverless NEG points directly to a single Cloud Run service, then the request is successful using the format https://internal_lb_url and omitting the service name. But this approach doesn't support multiple Cloud Run instances.

It appears Cloud Run can't process requests with the service name in the path, after the host. Does anyone know if there is a way around this i.e. to get Cloud Run to ignore the /service part of the url path?

[ChieKo]

Hi @rpmatthews1,

Welcome to the Google Cloud community!

It seems that the issue here is that there could’ve been is a mismatch between how your Serverless Network Endpoint Group (NEG) with URL masking is configured and how Cloud Run expects to receive requests. While the URL mask /<service> appears to work by routing to the correct Cloud Run service, Cloud Run itself doesn't interpret that /service portion as a routing directive. It only sees the request after the host, and since no Cloud Run service is configured to explicitly handle requests at that path, a 404 occurs.

You may check the Google Cloud's documentation that shows how to use API Gateway to manage requests to Serverless NEGs and Cloud Run services and this is the recommended approach.

I hope the above information is helpful.