Cloud CDN and Media CDN

A viewer resolves www.example.com to the load balancer’s anycast IP address and opens HTTPS to the nearest Google edge location, where the target proxy terminates TLS. The URL map chooses a backend from the host and path. If Cloud CDN is enabled on it, the edge computes the cache key and looks it up: on a hit the object is returned at once with an Age header; on a miss the request goes to the origin (the bucket, or the Cloud Run service through its serverless NEG), and the response is stored if the cache mode and the response headers allow it. Concurrent misses for the same key are coalesced, so a popular object is fetched from the origin once rather than once per viewer.

Derived from How Cloud CDN works.

Derived from Set up a global external Application Load Balancer with backend buckets and Using Cloud CDN with a backend bucket.

Reserve the address and create the backend bucket with Cloud CDN enabled.

Derived from gcloud compute backend-buckets create and gcloud compute addresses create.

If the bucket is private, grant the Cloud CDN service agent read access. The agent is service-<project-number>@cloud-cdn-fill.iam.gserviceaccount.com, created automatically the first time you add a signed request key to a backend bucket in the project (it belongs to Cloud CDN, so it does not appear in your project’s service accounts list); for a bucket that must stay private, serve it only through signed requests (see Private content: signed URLs and signed cookies).

Derived from Configuring signed URLs: grant the Cloud CDN service account access and gcloud storage buckets add-iam-policy-binding.

Create the serverless NEG and the backend service for the API, with Cloud CDN following the origin’s headers.

Derived from Set up a global external Application Load Balancer with Cloud Run and gcloud compute backend-services update.

Create the URL map with the bucket as default and route /api/* to the service.

Derived from gcloud compute url-maps add-path-matcher. === Certificates with Certificate Manager

Certificate Manager is the preferred certificate service for load balancers: it supports Google-managed and self-managed certificates, wildcards, many certificates per proxy through certificate maps, and issuing a certificate before DNS points at the load balancer, which avoids downtime when you migrate a site. The older per-proxy gcloud compute ssl-certificates resources still work but are limited to 15 certificates per proxy and need the DNS record in place before they provision.

The recommended Google-managed flow uses DNS authorization: you add a CNAME record that proves control of the domain, and the certificate provisions without any traffic reaching the load balancer.

Derived from Deploy a Google-managed certificate with DNS authorization and Certificate maps. The last command prints ACTIVE once the certificate is ready.

Create the proxy, the forwarding rule and the DNS record.

Derived from gcloud compute target-https-proxies create and gcloud compute forwarding-rules create.

Create an A record for www.example.com with the printed address. In Cloud DNS that is gcloud dns record-sets create "$DOMAIN." --zone=example-zone --type=A --ttl=300 --rrdatas=<ip-address>.

The redirect needs its own URL map, target HTTP proxy and port-80 forwarding rule on the same IP address.

Derived from Set up an HTTP-to-HTTPS redirect.

Derived from Caching overview and Using cache modes.

When both are present, Cache-Control: s-maxage governs shared caches such as Cloud CDN and takes precedence over max-age, which in turn takes precedence over Expires. A browser-oriented value that you want the edge to ignore belongs in max-age while s-maxage carries the CDN lifetime. Cloud CDN also honors Vary on a small set of headers and does not cache responses that set cookies unless the cache mode forces it.

Cloud CDN stores objects up to 10 MiB without byte-range support and up to 100 GiB with it; entries that are not requested for 30 days are evicted regardless of their TTL. Compression is applied by the origin or, for backend services and buckets with it enabled, as dynamic compression at the load balancer; keep Accept-Encoding out of the cache key and let Cloud CDN store each representation.

For Bookshelf, fingerprinted assets (app.4f9c1b.js) can have a long lifetime, while index.html should be short, so set the object metadata when uploading:

Derived from Cloud Storage object metadata: Cache-Control and gcloud storage cp.

By default the cache key is the whole request URI: protocol, host and path plus the complete query string. Two requests that differ only in a tracking parameter such as utm_source are therefore different objects. On backend services (and on buckets that expose query-sensitive content) you can shape the key:

Derived from Cache keys and gcloud compute backend-services update.

The key can also include named request headers and cookies (--cache-key-include-http-header, --cache-key-include-named-cookie) and exclude the protocol or host. Every element you add multiplies the number of cached variants, which lowers the hit ratio; include only what really changes the response.

A cache hit carries an Age header (seconds since the object was stored). To expose the decision to clients, add a custom response header that uses the cdn_cache_status variable, which resolves to values such as hit, miss, revalidated, stale or uncacheable:

Derived from Custom headers and Logging and monitoring.

Test with curl -sI https://www.example.com/assets/app.js. The first request shows miss; the second shows hit and an Age header. Remove the diagnostic headers (or keep them only for staging) when you do not want to describe your caching to clients.

Derived from Invalidating cached content.

Invalidations are issued against the URL map, not the backend:

Derived from gcloud compute url-maps invalidate-cdn-cache.

A wildcard may only appear at the end of the path. The command waits unless you pass --async, and /* asks for confirmation because it empties the whole cache. You need compute.urlMaps.invalidateCache (included in roles/compute.loadBalancerAdmin). Invalidations are rate limited, so batch them with wildcards.

When objects are spread across many paths, cache tags let you invalidate by meaning instead of by URL. The origin labels responses with the Cache-Tag response header (a comma-separated list such as Cache-Tag: catalog,book-42), Cloud CDN remembers the tags with each cached object, and one invalidation removes everything that carries a tag. The tag command is currently in the beta command group; check the launch stage on the linked page before using it in a pipeline.

Derived from Invalidating cached content: by cache tag.

A key is 128 random bits, base64 encoded with the URL-safe alphabet. Each backend bucket or service can have up to three keys at once, so you can rotate by adding a new one, switching your signer, and deleting the old one.

Derived from Using signed URLs and gcloud compute backend-buckets add-signed-url-key.

Store the key file in Secret Manager (see Secret Manager and Cloud KMS) and delete the local copy; the signer, not the client, holds it. Keys are write-only: Google never shows them again. Requiring signatures is not by itself enough to protect the bucket, so remove public access from the bucket and rely on the Cloud CDN service agent read access shown earlier.

The gcloud compute sign-url command is convenient for testing:

Derived from gcloud compute sign-url. Omit the port from the URL; a signature computed over :443 does not match.

In an application, compute the HMAC yourself. The signature is the URL-safe base64 of an HMAC-SHA1 over URL?Expires=<epoch-seconds>&KeyName=<name>, appended as the Signature parameter. In Java:

Derived from Programmatically creating signed URLs. The service reads the key through Application Default Credentials and Secret Manager; no key file ships with the application.

For a signed cookie you sign a URL prefix (scheme, host and optional path, ending in /) instead of one URL, and the application sends it in a Cloud-CDN-Cookie cookie. The prefix matches as text, not as a directory boundary. See Using signed cookies.