Configure an origin

You can configure origins for Media CDN in many ways. This page shows you how to configure origins.

Configure a Cloud Storage bucket as an origin

Media CDN supports Cloud Storage buckets as backends for content. Each service can reference multiple buckets by configuring routes for host, paths, and other request attributes.

Cloud Storage buckets are configured by using the bucket URL, such as gs://my-bucket, as the origin address when creating an origin resource.

Console

  1. In the Google Cloud console, go to the Media CDN page.

    Go to Media CDN

  2. Click the Origins tab.

  3. Click Create origin.

  4. Enter a name for the origin. For example: cloud-storage-origin.

  5. Optional: Enter a description.

  6. For the Origin address, choose Select a Google Cloud Storage bucket.

  7. Browse to your Cloud Storage bucket and select it.

  8. For Cloud Storage, retain the default protocol and port settings.

  9. Optional: For origin request header overrides to take precedence over headers sent by the client or manipulated by route-level header actions, do the following:

    1. Select Enable origin override.
    2. In the Headers section, specify headers by adding one or more name-value pairs.

  10. Optional: Select a failover origin to try in case this origin becomes unreachable. You can update this field later.

  11. Select redirect conditions.

  12. Select retry conditions.

  13. For Max attempts, select the maximum number of attempts to fill cache from this origin.

  14. Optional: Specify the following timeout values:

    1. For Connect timeout, select the maximum duration to wait for the origin connection to be established.
    2. For Response timeout, select the maximum duration to allow for a response to complete.
    3. For Read timeout, select the maximum duration to wait between reads of a single HTTP connection or stream.

  15. Optional: Click Add label and specify one or more key-value pairs.

  16. Click Create origin.

gcloud

Use the gcloud edge-cache origins create command:

gcloud edge-cache origins create ORIGIN \
    --origin-address=ADDRESS

Replace the following:

  • ORIGIN: the name of the new origin
  • ADDRESS: the bucket name—for example, gs://my-bucket

This is the same whether the bucket is multi-regional, dual-region, or regional.

When configuring a service, you can route your video-on-demand content to one bucket and live streaming content to a second bucket. This is useful if you have different teams managing each workflow. To reduce cache fill latency, you can similarly route the eu-media.example.com region to a multiregional Cloud Storage bucket located in the EU and the us-media.example.com region (or match on path, header, or query parameter) to a US-based storage bucket.

Media CDN buckets.
Media CDN buckets (click to enlarge).

For cases where write latency is critical, such as low-latency live streaming, you can configure a regional Cloud Storage endpoint as close to your users as possible.

Authenticate requests

To confirm that a request is coming from Media CDN, use one of the following supported approaches:

  • Validate that the connecting IP address is from Media CDN's cache fill ranges. These ranges are shared across all customers, but are always used by EdgeCacheService resources when connecting to an origin.
  • Add a custom request header with a token value that you validate on the origin (for example, a random 16-byte value). Your origin can then reject requests that don't include this value.

Configure an origin protocol

If your origin supports HTTP/2, you don't need to explicitly set the protocol. For origins that support only HTTPS (HTTP/1.1 over TLS) or HTTP/1.1 (without TLS), set the protocol field explicitly by doing the following:

Console

  1. In the Google Cloud console, go to the Media CDN page.

    Go to Media CDN

  2. Click the Origins tab.

  3. Select your origin and click Edit.

  4. For the protocol, select HTTPS or HTTP. For HTTP, also specify the port as 80.

  5. Click Update origin.

gcloud

Use the gcloud edge-cache origins update command:

gcloud edge-cache origins update LEGACY_ORIGIN \
    --protocol=HTTPS

Replace LEGACY_ORIGIN with the name of the origin.

Configure private Cloud Storage buckets

Media CDN can pull content from any internet-reachable HTTP or HTTPS endpoint. In some cases, you might want to require authentication, in order to only allow Media CDN to pull content, and prevent unauthorized access. Cloud Storage supports this through IAM permissions.

For Cloud Storage origins, do the following:

  • Grant the Media CDN service account the objectViewer IAM permission on the Cloud Storage buckets you are using as your origins.
  • Remove the allUsers permission.
  • Optional: Remove the allAuthenticatedUsers permission.

To change permissions of a Cloud Storage bucket, you need the Storage Admin role (roles/storage.admin).

The Media CDN service account is owned by the Media CDN project, and it won't appear in your project's list of service accounts. The service account grants access only to Media CDN resources in the projects that you explicitly allow.

You must create at least one Media CDN resource to trigger service account creation. In most cases, this is the EdgeCacheOrigin resource connected to your Cloud Storage bucket.

To grant Media CDN access to a bucket, grant the objectViewer role to the service account:

gcloud storage buckets add-iam-policy-binding gs://BUCKET \
    --member=serviceAccount:service-PROJECT_NUMBER@gcp-sa-mediaedgefill.iam.gserviceaccount.com \
    --role=roles/storage.objectViewer

Replace PROJECT_NUMBER with the project number.

Before removing public access to an existing storage bucket used as a production origin, allow at least 10 minutes for the configuration to propagate.

Use the gcloud storage buckets remove-iam-policy-binding command to remove permissions granted to the allUsers role for the given bucket. For example, if the bucket grants allUsers the objectViewer role, remove the grant using the following command:

gcloud storage buckets remove-iam-policy-binding gs://BUCKET \
    --member=allUsers --role=roles/storage.objectViewer

To validate that public access has been removed, open an incognito browser window and attempt to access a bucket object by using https://storage.googleapis.com/BUCKET/object.ext.

To allow EdgeCacheService resources within one project access to a Cloud Storage bucket in another project, you can grant the Media CDN service account in that project access to the storage bucket.

To do so, verify that PROJECT_NUMBER in service-PROJECT_NUMBER@gcp-sa-mediaedgefill.iam.gserviceaccount.com is the project number of the project with the EdgeCacheService resources that need access. You can repeat this for multiple projects, especially if some of them house different Media CDN environments (such as development, staging, or production) and a separate project contains your video or media assets.

You can protect access to your Cloud Storage origin without enabling signed requests for that route.

Configuring private Cloud Storage doesn't prevent your cached content from being directly accessed from Media CDN. For information about how you can issue signed requests to individual users, see signed requests.

Configure an external Application Load Balancer as an origin

If you require active health-checking, round-robin, or load-aware steering across Compute Engine, GKE, or on-premises origins, you can configure an external Application Load Balancer as an origin.

This lets you configure (for example) your live streaming packagers behind Media CDN or a group of Envoy proxies managed by Cloud Service Mesh for connecting back to your on-premises infrastructure.

Load balancers let you configure backends for the following:

An architecture that combines an external Application Load Balancer origin for serving video manifests and a Cloud Storage origin for segment storage resembles the following, with two origins mapped to different routes.

Edge cache deployment.
Edge cache deployment (click to enlarge).

To configure an external Application Load Balancer as an origin, you need to create an origin resource with the IP address or public hostname pointing to your load balancer's forwarding rules. A public hostname (domain name) is preferred because this is required for an SSL (TLS) certificate and for modern HTTP versions (HTTP/2 and HTTP/3).

You must also confirm the following:

  • Your load balancer has a route that matches the hostname used for your EdgeCacheService resource or that you have configured a urlRewrite.hostRewrite for routes where your load balancer is configured as the origin.
  • Your load balancer has a publicly trusted SSL (TLS) certificate configured for these hostnames.