security(iac/gcp): set allow_unauthenticated=false; document ingress override by cristim · Pull Request #586 · LeanerCloud/CUDly

cristim · 2026-05-20T16:51:23Z

Summary

Two related Cloud Run security/ops fixes to all three environment tfvars (dev, staging, prod):

#384 - allow_unauthenticated=false: cloud_run_allow_unauthenticated was set to true in all three tfvars, overriding the variable default of false. Cloud Run's built-in IAM auth is a defence-in-depth layer independent of our application-level JWT auth; it was unintentionally disabled. Setting it to false re-enables it.

#78 - Document ingress override: cloud_run_ingress = "INGRESS_TRAFFIC_ALL" is a temporary override because the external HTTPS LB + Cloud Armor stack (enable_cdn=true) has not yet been provisioned. The variable default (INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER) would block *.run.app traffic until DNS + cert + LB are in place. Updated inline comments to cross-reference both issues and state the removal condition.

Closes #384
Closes #78

Test plan

terraform fmt -check passes on all three tfvars files
Pre-commit hooks pass

Summary by CodeRabbit

Chores
- Cloud Run services now require authentication in development, staging, and production environments.

…override (closes #384, #78) #384: cloud_run_allow_unauthenticated was incorrectly set to true in all three environment tfvars, overriding the variable default of false. Cloud Run's built-in IAM auth is a defence-in-depth layer independent of our application-level JWT auth; it was unintentionally disabled. Set it to false in dev, staging, and prod. #78: cloud_run_ingress is temporarily set to INGRESS_TRAFFIC_ALL in all environments because the external HTTPS LB + Cloud Armor stack (enabled by enable_cdn=true) has not yet been provisioned. The variable default is INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER, which would block *.run.app traffic until DNS + cert + LB are in place. Update the inline comments to cross-reference both issues and explain the removal condition.

coderabbitai · 2026-05-20T16:51:30Z

Warning

Review limit reached

@cristim, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 27 minutes and 49 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4b614335-68be-438e-87bf-51b4232d8bf7

📥 Commits

Reviewing files that changed from the base of the PR and between bc8831b and 54cf45b.

📒 Files selected for processing (8)

terraform/environments/gcp/README.md
terraform/environments/gcp/compute.tf
terraform/environments/gcp/dev.tfvars.example
terraform/environments/gcp/github-dev.tfvars
terraform/environments/gcp/github-prod.tfvars
terraform/environments/gcp/github-staging.tfvars
terraform/environments/gcp/variables.tf
terraform/modules/compute/gcp/cloud-run/main.tf

📝 Walkthrough

Walkthrough

Three GCP Terraform environment configurations disable unauthenticated Cloud Run access by setting cloud_run_allow_unauthenticated = false across development, staging, and production environments. Associated documentation comments explain temporary ingress override behavior and future provisioning expectations.

Changes

Cloud Run Unauthenticated Access Hardening

Layer / File(s)	Summary
Disable unauthenticated Cloud Run access across all environments `terraform/environments/gcp/github-dev.tfvars`, `terraform/environments/gcp/github-prod.tfvars`, `terraform/environments/gcp/github-staging.tfvars`	All three environment tfvar files set `cloud_run_allow_unauthenticated = false` and update documentation comments to explain the temporary ingress override state when `enable_cdn = false` and future behavior once the CDN/LB stack is provisioned (references `#78` and `#384`).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 Three fortresses now guard their Cloud Run gates,
No allUsers shall pass—authentication waits,
The comments explain this temporary hold,
Till LB and armor stand brave and bold! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main changes: disabling unauthenticated Cloud Run access and documenting the temporary ingress override across all three GCP environment tfvars files.
Linked Issues check	✅ Passed	The PR fulfills both linked issues by disabling cloud_run_allow_unauthenticated in all three tfvars (`#384`) and documenting the INGRESS_TRAFFIC_ALL override with references to `#78` and `#384` (`#78`).
Out of Scope Changes check	✅ Passed	All changes are scoped to the three GCP tfvars files and directly address the security objectives from `#384` and `#78` with no unrelated modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch security/gcp-cloudrun-auth-384-78

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cristim · 2026-05-20T16:51:50Z

@coderabbitai review

coderabbitai · 2026-05-20T16:51:56Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-05-22T10:39:58Z

@coderabbitai review

coderabbitai · 2026-05-22T10:40:03Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-05-22T22:22:26Z

@coderabbitai review

coderabbitai · 2026-05-22T22:22:30Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-05-25T16:34:05Z

@coderabbitai review

coderabbitai · 2026-05-25T16:34:10Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-05-27T16:45:00Z

@coderabbitai review

coderabbitai · 2026-05-27T16:45:05Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-05-27T18:19:48Z

@coderabbitai full review

coderabbitai · 2026-05-27T18:19:54Z

✅ Actions performed

Full review triggered.

…_cdn (mirrors PR #574 AWS pattern) Replace the unconditional `cloud_run_allow_unauthenticated = false` override with a derived `local.cloud_run_allow_unauthenticated = !var.enable_cdn` in `terraform/environments/gcp/compute.tf`. The IAM gate now flips in lock-step with the LB stack landing, matching the parallel pattern shipped in #574 for AWS Lambda Function URL auth: AWS (#574): local.lambda_function_url_auth_type = var.enable_cdn ? "AWS_IAM" : "NONE" GCP (this): local.cloud_run_allow_unauthenticated = !var.enable_cdn Why the conditional rather than always-false: * enable_cdn = false (today's dev/staging/prod): the SPA / clients hit the *.run.app URL directly. Browsers cannot present a Google-signed identity token, so the IAM gate must accept allUsers (allow_unauthenticated = true); auth is enforced at the application layer (login session, CSRF, OIDC for scheduled tasks). The previous unconditional `= false` would have made the *.run.app URL return 403 to direct browser hits — exactly the GCP analog of PR #574's mis-configuration (b). * enable_cdn = true (post-LB-cutover): the external HTTPS LB (with Cloud Armor) fronts the service and attaches a Google-signed identity to upstream calls, so Cloud Run can enforce `roles/run.invoker` on the LB SA only and lock allUsers out at the IAM layer (closes #384). The pairing also blocks mis-configuration (a) — `enable_cdn = true` with allow_unauthenticated = true would put a public *.run.app URL behind a pointless LB. The AWS analog of CloudFront's OAC + SigV4 signing is the GCP LB SA's identity token. The two cloud sides now share the same "auth gate is derived from the fronting-LB toggle" shape. Changes: * terraform/environments/gcp/compute.tf: add `locals { cloud_run_allow_ unauthenticated = !var.enable_cdn }` with a comment block mirroring #574's documentation of the two valid combinations + the two mis-configurations it prevents. Wire `module.compute_cloud_run.allow_unauthenticated` to the local. Update the scheduled-tasks comment block (#159) to point at the new derivation. * terraform/environments/gcp/variables.tf: drop the operator-facing `cloud_run_allow_unauthenticated` variable declaration, replace with a comment block that explains the derivation (parallel to #574's treatment of `lambda_function_url_auth_type`). Update `cloud_run_ingress` description's cross-reference accordingly. * terraform/environments/gcp/{github-dev,github-staging,github-prod, dev.tfvars.example}.tfvars: remove the `cloud_run_allow_unauthenticated` line from all 4 tfvars files; add a short comment near the existing ingress override noting the derivation. * terraform/environments/gcp/README.md: update the "Cloud Run ingress" table — `allow_unauthenticated` row now describes it as derived from `enable_cdn`, not a directly-set variable; clarify that when an env flips `enable_cdn = true` the IAM gate auto-closes alongside dropping the `cloud_run_ingress` override. * terraform/modules/compute/gcp/cloud-run/main.tf: refresh the inline comment on the scheduled-task http_target — the IAM gate now references #384 (the derivation) rather than #78 (the network gate). The `cloud_run_ingress = "INGRESS_TRAFFIC_ALL"` override in the 3 env tfvars stays exactly as it was — that's a sibling concern (network door) tracked by #78 and gated on the same LB cutover, but kept as an explicit override per the existing comment so the network-vs-IAM doors are managed in lockstep but visibly separately. Verified: terraform fmt -check clean on both modules/compute/gcp and environments/gcp; terraform validate clean on both layers. Refs #384, #78, #574

cristim · 2026-05-27T22:14:29Z

Reworked per design discussion: cloud_run_allow_unauthenticated is now derived from enable_cdn (mirrors PR #574's lambda_function_url_auth_type pattern). When CDN is enabled, the LB fronts with Google identity and Cloud Run locks down via IAM; when CDN is disabled (dev), allow_unauthenticated stays true so *.run.app browsers can reach the service. Tfvars overrides dropped across all 3 envs + dev.tfvars.example, env-layer variable deleted, README updated. @coderabbitai review

coderabbitai · 2026-05-27T22:14:52Z

@cristim: Understood — the new approach elegantly ties cloud_run_allow_unauthenticated to enable_cdn at the module level, removing per-env override noise and aligning with the Lambda URL auth pattern from #574. Triggering a review of the updated changes now.

✏️ Learnings added

Learnt from: cristim
URL: https://github.com/LeanerCloud/CUDly/pull/586

Timestamp: 2026-05-27T22:14:50.735Z
Learning: In the CUDly repository (GCP Terraform), `cloud_run_allow_unauthenticated` is derived from `enable_cdn` at the module level rather than set per-environment in tfvars. When `enable_cdn = true`, the external HTTPS LB + Cloud Armor stack fronts the service with Google identity and Cloud Run locks down via IAM (`allow_unauthenticated = false`). When `enable_cdn = false` (e.g., dev), `allow_unauthenticated = true` so browsers can reach the service directly via `*.run.app`. This mirrors PR `#574`'s `lambda_function_url_auth_type` pattern. Per-env tfvars overrides for `cloud_run_allow_unauthenticated` should not be present; the env-layer variable has been deleted.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

✅ Actions performed

Full review triggered.

cristim added triaged Item has been triaged priority/p2 Backlog-worthy severity/medium Moderate harm urgency/this-quarter Within the quarter impact/all-users Affects every user labels May 20, 2026

cristim added type/security Security finding effort/m Days labels May 20, 2026

cristim merged commit dc7cf48 into feat/multicloud-web-frontend May 27, 2026
4 checks passed

This was referenced May 28, 2026

security(iac/gcp): all environments set cloud_run_allow_unauthenticated=true + INGRESS_TRAFFIC_ALL — no IAM gate on Cloud Run #384

Closed

ops(gcp): take Cloud Run secure-ingress default into effect (per-env LB enablement + override removal) #78

Closed

cristim deleted the security/gcp-cloudrun-auth-384-78 branch June 3, 2026 21:55

Uh oh!

Conversation

cristim commented May 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

cristim commented May 20, 2026

Uh oh!

coderabbitai Bot commented May 20, 2026

Uh oh!

cristim commented May 22, 2026

Uh oh!

coderabbitai Bot commented May 22, 2026

Uh oh!

cristim commented May 22, 2026

Uh oh!

coderabbitai Bot commented May 22, 2026

Uh oh!

cristim commented May 25, 2026

Uh oh!

coderabbitai Bot commented May 25, 2026

Uh oh!

cristim commented May 27, 2026

Uh oh!

coderabbitai Bot commented May 27, 2026

Uh oh!

cristim commented May 27, 2026

Uh oh!

coderabbitai Bot commented May 27, 2026

Uh oh!

cristim commented May 27, 2026

Uh oh!

coderabbitai Bot commented May 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cristim commented May 20, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 20, 2026 •

edited

Loading