Exam Professional Cloud Developer topic 1 question 268 discussion

https://cloud.google.com/run/docs/securing/ingress https://cloud.google.com/scheduler/docs/tut-gcf-pub-sub https://cloud.google.com/beyondcorp-enterprise/docs/securing-kubernetes-engine

Cloud Scheduler can trigger Cloud Run services, but in this case, where the ingress is set to 'Internal', direct invocation might not work. Instead, you can use Cloud Scheduler in combination with Pub/Sub. Cloud Scheduler can create a Pub/Sub message on a schedule, and this Pub/Sub message can then trigger the Cloud Run service. This approach is commonly used for invoking services with restricted network access.

Cloud Scheduler can trigger Cloud Run services, but in this case, where the ingress is set to 'Internal', direct invocation might not work. Instead, you can use Cloud Scheduler in combination with Pub/Sub. Cloud Scheduler can create a Pub/Sub message on a schedule, and this Pub/Sub message can then trigger the Cloud Run service. This approach is commonly used for invoking services with restricted network access.

D. When setting PubSub subscription, use type push and use the service account with the invoker role as authentication. A. no need more permissions. B. it could work id the vms are in the same VPC, but it is not best practice. C. That setting is only for connecting to load balancer

D. is the best solution because it effectively circumvents the limitation of the Internal ingress setting of Cloud Run. This setting restricts external access, which is likely causing the 403 error. By using Cloud Scheduler to trigger a Pub/Sub topic, and then having Pub/Sub trigger the Cloud Run service, you maintain internal access security while enabling external scheduling. This method is both secure and adheres to the internal-only access requirements, leveraging managed services for scalability and reliability.