Outbound static IP address configuration

This guide describes how to use a static IP address to allow the Cloud Run service to send requests over Cloud NAT.

For outbound static IP address settings,

Please refer to this link.

When developing a system, there are many situations where it is necessary to cooperate with an external system.

Depending on the other system, it may be necessary to add all the source IPs to the White list.

In this case, if you simply scale the Worker, it may be difficult to register all the IPs with the other system because the number of outgoing IPs increases as the number of instances increases.

In such a case, create a VPC network and set up Cloud NAT.

Cloud NAT allows you to communicate from the same fixed IP via a scalable network router when communicating to the outside world.

Creating a VPC network

Make the necessary settings to scale the network, such as VPC network and firewall settings.

$ souls gcloud compute setup_vpc_nat

By this command

• Creating a VPC network
• Creating Firewall TCP rules
• Creating Firewall SSH rules
• Creating a network subnet
• Creating a VPC access connector
• Creating a Router
• Obtaining an External IP
• Creating Cloud NAT

Is done automatically.

Set up a private IP for Cloud SQL

Use the SOULs command to configure your instance of Google Cloud SQL for private IP.

$ souls gcloud sql setup_private_ip

By this command

• Creating a VPC IP address range
• Creating a VPC Peering Connector
• Enable Cloud SQL Private IP

Is done automatically.

Editing .github / worker-*.yml

Add the two options output to the console to Workflow in Github Actions.

.github/workflow/worker.yml

# 中略 #
  name: Deploy to Cloud Run
  run: |
    gcloud run deploy ${{ secrets.APP_NAME }}-mailer \
      --service-account=${{ secrets.APP_NAME }}@${{ secrets.GCP_PROJECT_ID }}.iam.gserviceaccount.com \
      --image=gcr.io/${{ secrets.GCP_PROJECT_ID }}/${{secrets.APP_NAME}}-mailer \
+     --vpc-connector=souls-app-connector \
+     --vpc-egress=all \
      --memory=4Gi \
      --region=asia-northeast1 \
      --allow-unauthenticated \
      --platform=managed \
      --quiet \
      --concurrency=80 \
      --port=8080 \
      --set-cloudsql-instances=${{ secrets.GCLOUDSQL_INSTANCE }} \
      --set-env-vars="DB_USER=${{ secrets.DB_USER }}" \
      --set-env-vars="DB_PW=${{ secrets.DB_PW }}" \
      --set-env-vars="DB_HOST=${{ secrets.DB_HOST }}" \
      --set-env-vars="TZ=${{ secrets.TZ }}" \
      --set-env-vars="SLACK=${{ secrets.SLACK }}" \
      --set-env-vars="SECRET_KEY_BASE=${{ secrets.SECRET_KEY_BASE }}" \
      --set-env-vars="PROJECT_ID=${{ secrets.GCP_PROJECT_ID }}"

Editing .github / api.yml

Also connect to the VPC Connector in the API api.yml

--vpc-connector=souls-app-connector

Add only one line of.

.github/workflow/api.yml

# 中略 #
  name: Deploy to Cloud Run
  run: |
    gcloud run deploy ${{ secrets.APP_NAME }}-mailer \
      --service-account=${{ secrets.APP_NAME }}@${{ secrets.GCP_PROJECT_ID }}.iam.gserviceaccount.com \
      --image=gcr.io/${{ secrets.GCP_PROJECT_ID }}/${{secrets.APP_NAME}}-mailer \
+     --vpc-connector=souls-app-connector \
      --memory=4Gi \
      --region=asia-northeast1 \
      --allow-unauthenticated \
      --platform=managed \
      --quiet \
      --concurrency=80 \
      --port=8080 \
      --set-cloudsql-instances=${{ secrets.GCLOUDSQL_INSTANCE }} \
      --set-env-vars="DB_USER=${{ secrets.DB_USER }}" \
      --set-env-vars="DB_PW=${{ secrets.DB_PW }}" \
      --set-env-vars="DB_HOST=${{ secrets.DB_HOST }}" \
      --set-env-vars="TZ=${{ secrets.TZ }}" \
      --set-env-vars="SLACK=${{ secrets.SLACK }}" \
      --set-env-vars="SECRET_KEY_BASE=${{ secrets.SECRET_KEY_BASE }}" \
      --set-env-vars="PROJECT_ID=${{ secrets.GCP_PROJECT_ID }}"

GitHub Actions Secret key update

Since I created a Private IP for Google Cloud SQL, I used the PRIVATE_ADDRESS I got earlier.

Overwrite DB_HOST on GitHub.

PRIVATE_ADDRESS can be displayed with the following command.

$ souls gcloud sql list
NAME              DATABASE_VERSION  LOCATION           TIER              PRIMARY_ADDRESS  PRIVATE_ADDRESS  STATUS
souls-app-db  POSTGRES_13       asia-northeast1-b  db-custom-2-7680  31.142.0.103     10.18.0.2        RUNNABLE

Set PRIVATE_ADDRESS DB_HOST on GitHub Secret.

Deploy

$ git add .
$ git commit -m "add cloud nat"
$ git push origin main