Custom Domain Mapping and Automated SSL Management for GCP Cloud Run & Cloud Storage

When launching production microservices on GCP Cloud Run or hosting static frontend assets on Google Cloud Storage (GCS), serving traffic under custom brand domain names (such as api.mycompany.com or assets.mycompany.com) is an essential branding and security requirement.

In this technical walkthrough, we cover both native Cloud Run Domain Mapping and Global Load Balancer Domain Mapping for Cloud Run services and GCS buckets, including zero-touch Google-managed SSL certificate provisioning.

Option 1: Native Cloud Run Domain Mapping

For straightforward single-region services, GCP Cloud Run provides built-in domain mapping:

# Create Domain Mapping via gcloud CLI
gcloud beta run domain-mappings create \
  --service=api-server \
  --domain=api.example.com \
  --region=us-central1

Option 2: Cloud Storage (GCS) Custom Domain Mapping

To serve static web assets, images, or single-page apps directly from a GCS bucket under cdn.example.com:

Automated TLS / SSL Certificate Provisioning

Both Cloud Run Domain Mappings and GCP Load Balancers automatically issue and renew 90-day Let's Encrypt / Google Trust Services TLS certificates. Once DNS records propagate (typically 5 to 15 minutes), HTTPS is enforced automatically with zero manual certificate key rotations required.