gRPC, Cloud Run & Endpoints

March 25, 2020 - 5 minutes read - 918 words

<3 Google but there’s quite often an assumption that we’re all sitting around the engineering table and, of course, we’re not.

Cloud Endpoints is a powerful offering but – IMO – it’s super confusing to understand and complex to deploy.

If you’re familiar with the motivations behind service meshes (e.g. Istio), Cloud Endpoints fits in a similar niche (“neesh” or “nitch”?). The underlying ambition is that, developers can take existing code and by adding a proxy (or sidecar), general-purpose abstractions, security, logging etc. may be added.

With Cloud Endpoints, the goals are to leverage general-purpose authentication|authorization, logging and monitoring mechanisms offered by Google. And, more specifically, the ability to define your services’ APIs to Google’s infrastructure using either OpenAPI (nee Swagger) or Protobuf so that you may expose, secure, monetize etc. your APIs.

For a long time, Google used NGINX as a proxy (a) underpinning its Cloud Endpoints ESP (“Extensible Service Proxy”); (b) and also the sidecar deploying alongside your App Engine flexible apps. For good reasons, Envoy has become a darling of the proxy scene and, with Google’s commitment to Istio (and beyond), Envoy has become the proxy underpinning the new version of ESP, ESPv2.

A roundabout way of saying that, when you add Cloud Endpoints to your service, you generally want to route all traffic through ESP and have it proxy the traffic to your backend. By so doing, ESP is able to instrument and secure your API calls among other things.

Having been toying with Cloud Run this week (Golang and Rust samples for gRPC in Cloud Run), I was compelled to follow a Google tutorial Getting Started with Endpoint for Cloud Run to bring everything together and make grpcurl calls to ESPv2 running under Cloud Run proxying traffic to the Golang|Rust gRPC servers also running under Cloud Run.

Google’s documentation is good although I believe the seemingly optional step of Building a new ESPv2 Beta Image is mandatory (issue).

I’m always one for bash scripting the shit out of tutorials ;-)

Assume you’re able to ./deploy.sh ${PROJECT} [node|pythongolang|rust] from Google’s gRPC in Google Cloud Run repo, the following should rebuild and deploy the ESPv2 proxy under Cloud Run, configure Cloud Endpoints and route a test grpcurl through the proxy for you:

#!/bin/bash

# Assumes the grpc-calculator service has been deployed to the project
# See ${HOME}/Projects/grpc-cloud-run-examples/

# Parameters from Environment
: "${PROJECT:?Need to set PROJECT to GCP Project ID}"
: "${REGION:?Need to set REGION to GCP region}"

# The ESPv2 Cloud Run service will be named "proxy"
# Assumes (!) the existence of a Cloud Run service "grpc-calculator"
ESP="proxy"
SRV="grpc-calculator"

# If not present, download protoc and add it to the path
VERS="3.11.4"
ARCH="linux-x86_64"
if [ ! -d ./protoc-${VERS}-${ARCH} ]
then
  wget \
  https://github.com/protocolbuffers/protobuf/releases/download/v${VERS}/protoc-${VERS}-${ARCH}.zip \
  --output-document=./protoc-${VERS}-${ARCH}.zip
  unzip -o protoc-${VERS}-${ARCH}.zip -d ./protoc-${VERS}-${ARCH}
fi

PATH=${PATH}:${PWD}/protoc-${VERS}-${ARCH}/bin

# Generate the Protobuf Descriptor file
protoc \
--include_imports \
--include_source_info \
--proto_path=. \
--descriptor_set_out=api_descriptor.pb \
calculator.proto

# Cloud Build is here to rebuild the ESPv2 image
for SERVICE in "cloudbuild" "endpoints" "servicecontrol" "servicemanagement"
do
  gcloud services enable ${SERVICE}.googleapis.com \
  --project=${PROJECT}
done

# Need to deploy ESP proxy in order to be able to query it for configuration in api_config.yaml
# However, this ESP version must be redeployed before the project will work
# See `Rebuild ESP Image` below
gcloud run deploy ${ESP} \
--image="gcr.io/endpoints-release/endpoints-runtime-serverless:2" \
--allow-unauthenticated \
--platform managed \
--project=${PROJECT} \
--region=${REGION}

# Query Cloud Run for service endpoints (Proxy, Calculator)
ESP_HOST=$(\
  gcloud run services list \
  --project=${PROJECT} \
  --region=${REGION} \
  --platform=managed \
  --format="value(status.address.url)" \
  --filter="metadata.name=${ESP}") 
ESP_HOST=${ESP_HOST#https://} && echo ${ESP_HOST}

# This should have been deployed
SRV_HOST=$(\
  gcloud run services list \
  --project=${PROJECT} \
  --region=${REGION} \
  --platform=managed \
  --format="value(status.address.url)" \
  --filter="metadata.name=${SRV}") 
SRV_HOST=${SRV_HOST#https://} && echo ${SRV_HOST}

# Construct api_config.yaml using the Endpoints
echo '
type: google.api.Service
config_version: 3
name: ESP_HOST
title: gRPC Calculator Service
apis:
  - name: Calculator
usage:
  rules:
    - selector: Calculator.Calculate
      allow_unregistered_calls: true
backend:
  rules:
    - selector: "*"
      address: grpcs://SRV_HOST
' |\
sed "s|name: ESP_HOST|name: ${ESP_HOST}|g" |\
sed "s|address: grpcs://SRV_HOST|address: grpcs://${SRV_HOST}|g" \
> api_config.yaml

# Deploy the Endpoints service
gcloud endpoints services deploy api_descriptor.pb api_config.yaml \
--project=${PROJECT}

# Tidy
rm api_config.yaml

# Rebuild ESP image
CONFIG="$(\
  gcloud endpoints configs list \
  --service=${ESP_HOST} \
  --project=${PROJECT} \
  --format="json" \
  | jq -r .[0].id)"
./gcloud_build_image \
-s ${ESP_HOST} \
-c ${CONFIG} \
-p ${PROJECT}

# Redeploy the Cloud Run ESP proxy
gcloud run deploy ${ESP} \
--image=gcr.io/${PROJECT}/endpoints-runtime-serverless:${ESP_HOST}-${CONFIG} \
--allow-unauthenticated \
--platform=managed \
--region=${REGION} \
--project=${PROJECT}

# Permit Cloud Run services (i.e. Proxy)
# running as ${PROJECT_NUM}-compute@
# to invoke Cloud Run services (i.e. Calculator)
PROJECT_NUM=$(\
  gcloud projects describe ${PROJECT} \
  --format="value(projectNumber)")
EMAIL=${PROJECT_NUM}-compute@developer.gserviceaccount.com
gcloud run services add-iam-policy-binding ${SRV} \
--member=serviceAccount:${EMAIL} \
--role=roles/run.invoker \
--platform=managed \
--region=${REGION} \
--project=${PROJECT}

# Test
grpcurl \
-d '{"first_operand": 2.0, "second_operand": 3.0, "operation": "ADD"}' \
-proto calculator.proto \
${ESP_HOST}:443 Calculator.Calculate

# Tidy
rm api_descriptor.pb

All being well, this should conclude with:

{
  "result": 5
}

Yes, one of the world’s most resource-intensive calculators :-)

When you’re done, you must delete the Endpoints service first as a lien is applied to it:

ESP="proxy"

ESP_HOST=$(\
  gcloud run services list \
  --project=${PROJECT} \
  --region=${REGION} \
  --platform=managed \
  --format="value(status.address.url)" \
  --filter="metadata.name=${ESP}") 
ESP_HOST=${ESP_HOST#https://} && echo ${ESP_HOST}

gcloud endpoints services delete ${ESP_HOST} \
--project=${PROJECT} \
--quiet

And then you can optionally delete the Cloud Run services:

SRV="grpc-calculator"

for SERVICE in "${ESP}" "${SRV}"
do
  gcloud run services delete ${SERVICE} \
  --platform=managed \
  --region=${REGION} \
  --project=${PROJECT} \
  --quiet
done

And then – if you’re absolutely certain you don’t need any of its resource – sure? Whack the entire project:

gcloud projects delete ${PROJECT} --quiet

HTH!