GCP Cloud Run internal networking not secured and unencrypted

Question

i am currently getting my head around "gcp cloud run". my biggest concern at the moment is that it seems traffic behind the endpoint (loadbalancer) is not encrypted up to the container instance. is that assumption correct?

client -> internet -> gloud run endpoint (TLS) -> 1-n "my container instance(s)" on port 8080 (http, unencrypted, on shared gcp infrastructure)

that would be a no-go for my companies security policies which say that all traffic um to the instance needs to be "encrypted in transport"

from the unofficial cloud run faq i read this (which doesn't really make sense to me)

Answer 1

Traffic is entirely encrypted all the time during request. After termination of TLS connection at GFE, request is encapsulated into RPC call with Application Layer Transport Security. These RPC's are authenticated and encrypted. 

Please check this part of the documentation for more insights.