GCP Cloud Run中APISIX连接上游实例的404问题求助

部署配置 #

Dockerfile #

FROM apache/apisix

COPY ./configs/config.yaml /usr/local/apisix/conf/config.yaml
COPY ./configs/apisix.yaml /usr/local/apisix/conf/apisix.yaml

configs/apisix.yaml #

routes:
  - 
    uri: /hello
    plugins:
      proxy-rewrite:
        uri: /hello
    upstream:
      nodes:
        "<CLOUD_RUN_URL>.run.app": 1
      scheme: https
#END

configs/config.yaml #

deployment:
  role: data_plane
  role_data_plane:
    config_provider: yaml
#END

Terraform部署代码（main.tf） #

# APISIX Docker Image
data "google_artifact_registry_docker_image" "apisix_image" {
  project       = var.project_id
  location      = "europe-west3"
  repository_id = <ARTIFACT_REGISTRY>
  image_name    = "<APISIX_IMAGE>:latest"
}

# Cloud Run APISIX
resource "google_cloud_run_v2_service" "apisix" {
  project  = var.project_id
  location = "europe-west3"
  name     = "apisix"
  ingress  = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"

  template {
    containers {
      image = data.google_artifact_registry_docker_image.apisix_image.self_link
      ports {
        container_port = 9080
      }
      env {
        name  = "APISIX_STAND_ALONE"
        value = true
      }
    }
    vpc_access {
      egress = "ALL_TRAFFIC"
      network_interfaces {
        network    = "<NETWORK_NAME>"
        subnetwork = "<SUBNETWORK_NAME>"
      }
    }
  }
}

# Cloud Run Upstream API
resource "google_cloud_run_v2_service" "api" {
  project  = var.project_id
  location = "europe-west3"
  name     = "upstream-api"
  ingress  = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"

  template {
    containers {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }
}

错误现象 #

部署完成后，访问APISIX的/hello路径返回404错误，请求从未到达上游Cloud Run容器。APISIX的日志显示：

return (<APISIX_Cloud_Run_URL> "GET /hello HTTP/1.1" 404 36 0.050 "-" "curl" 199.36.153.9:443 404 0.019 "<APISIX_Cloud_Run_URL>/hello"
)

可见APISIX能正确解析上游IP，但请求转发失败。用同网络配置的FastAPI Cloud Run服务可以正常访问该上游，推测问题出在APISIX的配置或转发逻辑上。

补充信息 #

若在上游Cloud Run前配置内部负载均衡器，将其内部IP或私有域名设为APISIX上游节点则可正常访问，说明APISIX能够访问内部IP/域名，但直接使用Cloud Run URL时无法正常转发请求。

排查建议与解决方案 #

• 确保正确传递Host头：Cloud Run服务依赖匹配自身域名的Host头来路由请求，APISIX默认可能未传递正确的Host。修改apisix.yaml的路由配置，添加Host头设置：

  routes:
    - 
      uri: /hello
      plugins:
        proxy-rewrite:
          uri: /hello
          host: "<CLOUD_RUN_URL>.run.app"
      upstream:
        nodes:
          "<CLOUD_RUN_URL>.run.app": 1
        scheme: https
  

  或者使用proxy-set-header插件显式设置Host：

  plugins:
    proxy-set-header:
      headers:
        Host: "<CLOUD_RUN_URL>.run.app"
  

• 检查HTTPS代理的SSL验证：尝试临时禁用上游SSL验证（生产环境不推荐，仅用于排查），确认是否为SSL验证问题：

  upstream:
    nodes:
      "<CLOUD_RUN_URL>.run.app": 1
    scheme: https
    tls:
      verify: false
  

• 确认Cloud Run私有访问配置：上游Cloud Run的ingress设置为INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER，需确保已为该服务启用私有服务访问，且APISIX所在VPC能解析Cloud Run的私有域名。

• 查看APISIX debug日志：给APISIX的Cloud Run服务添加环境变量APISIX_LOG_LEVEL=debug，获取更详细的请求转发日志，分析请求在APISIX内部的处理流程。

• 容器内直接测试上游访问：通过gcloud run services exec apisix -- curl <CLOUD_RUN_URL>.run.app/hello命令进入APISIX容器，直接测试上游访问，排查网络连通性或请求头问题。

内容的提问来源于stack exchange，提问作者Brian