Envoy proxy for Cloud Run to enable gRPC Web Clients to connect. We only have one Cluster

envoy.yml

static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address: { address: 0.0.0.0, port_value: 8080 }
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          codec_type: auto
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match: { prefix: "/" }
                route:
                  cluster: api-gateway-proxy
                  auto_host_rewrite: true
                  max_stream_duration:
                    grpc_timeout_header_max: 0s
              cors:
                allow_origin_string_match:
                - prefix: "*"
                allow_methods: GET, PUT, DELETE, POST, OPTIONS
                allow_headers: keep-alive,user-agent,cache-control,content-type,content-transfer-encoding,custom-header-1,x-accept-content-transfer-encoding,x-accept-response-streaming,x-user-agent,x-grpc-web,grpc-timeout
                max_age: "1728000"
                expose_headers: custom-header-1,grpc-status,grpc-message
          http_filters:
          - name: envoy.filters.http.grpc_web
          - name: envoy.filters.http.cors
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  clusters:
  - name: api-gateway-proxy
    type: strict_dns
    connect_timeout: 20s
    http2_protocol_options: {}
    lb_policy: round_robin
    dns_refresh_rate: 90s
    load_assignment:
      cluster_name: api-gateway-proxy
      endpoints:
        - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
#                     this is the generated cloud run address
                    address: cloud-run-grpc-service-url-oa.a.run.app
                    port_value: 443
    dns_lookup_family: V4_ONLY
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        common_tls_context:
          alpn_protocols: h2
          validation_context:
            trusted_ca:
              filename: /etc/ssl/certs/ca-certificates.crt
        sni: cloud-run-grpc-service-url-oa.a.run.app

This is the Dockerfile you can use to Deploy the configuration above to Cloud Run. Envoy adds almost 4ms latency to each request.

If you don't want, you can start your service in Dart, then start Envoy in same container and expose Envoy port.

FROM envoyproxy/envoy-alpine:v1.21-latest
COPY envoy.yaml /etc/envoy/envoy.yaml
RUN apk --no-cache add ca-certificates
ENTRYPOINT /usr/local/bin/envoy -c /etc/envoy/envoy.yaml -l trace