title: Allowing internal traffic only for cloud function behind cloud endpoints
body: <p>I am currently setting up a series of cloud functions behind cloud endpoints (ESPv2).</p>
  <p>I already secured cloud functions by allowing only authenticated traffic from the cloud run service (like <a href="https://stackoverflow.com/questions/56006993/hide-cloud-functions-execution-behind-cloud-endpoints">here</a>).</p>
  <p>I was wondering if it were possible to also select &quot;internal traffic only&quot; as the ingress setting. I tried but I only get 403s when I enable it.</p>
  <p>This option should &quot;<em>only allow traffic from the same project or VPC</em>&quot;. The cloud run service is in the default VPC and both the function and service are in the same project.</p>
  <hr />
  <p><strong>Edit:</strong></p>
  <p>Function works and is available here:
  <a href="https://europe-west1-iota-beta-296214.cloudfunctions.net/api-keys" rel="nofollow noreferrer">https://europe-west1-iota-beta-296214.cloudfunctions.net/api-keys</a></p>
  <p>Accessing it through ESPv2 (Cloud Run) returns a 503 when using a VPC Connector (it works if no connector)
  <a href="https://functions.getiota.fr/auth/jwks" rel="nofollow noreferrer">https://functions.getiota.fr/auth/jwks</a></p>
  <p>Cloud Run image was built following <a href="https://cloud.google.com/endpoints/docs/openapi/get-started-cloud-functions" rel="nofollow noreferrer">google's tutorial</a> using a specific service account and VPC Connector (<a href="https://cloud.google.com/sdk/gcloud/reference/run/deploy" rel="nofollow noreferrer">see CLI doc</a>)</p>
  <p>Here is an extract of my endpoint service conf:</p>
  <pre><code>...
  host: functions.getiota.fr
  schemes:
    - https
  produces:
    - application/json
  paths:
    /auth/jwks:
      get:
        summary: Get the JSON web key set for authentication
        operationId: jwks
        x-google-backend:
          address: https://europe-west1-iota-beta-296214.cloudfunctions.net/api-keys
          protocol: h2
  ...
  
  </code></pre>
  <hr />
  <p><strong>Edit 2 with workaround:</strong></p>
  <p>After following the answer below, everything works fine if the ESPv2 is deployed on cloud run with <code>--set-env-vars=ESPv2_ARGS=--backend_dns_lookup_family=v4only</code>. This option is described <a href="https://cloud.google.com/endpoints/docs/openapi/specify-esp-v2-startup-options#platform" rel="nofollow noreferrer">here</a>.</p>
  <p>I followed with this issue on ESPv2's github: <a href="https://github.com/GoogleCloudPlatform/esp-v2/issues/423" rel="nofollow noreferrer">https://github.com/GoogleCloudPlatform/esp-v2/issues/423</a></p>