Static outbound IP address

gcloud

1. Find the name of your VPC network:

   gcloud compute networks list

   You should see output like the following:

   NAME     SUBNET_MODE  BGP_ROUTING_MODE
   default  AUTO         REGIONAL

   Identify the network that you'll attach to your Serverless VPC Access connector.

2. Create a subnet in the VPC for the Serverless VPC Access connector.

   gcloud compute networks subnets create SUBNET_NAME \
   --range=RANGE --network=NETWORK_NAME --region=REGION

   Replace the following values in this command:

   • SUBNET_NAME with a name you want to give to the subnet.
   • RANGE with the IP range in CIDR format you want to assign to this subnet (for example, 10.124.0.0/28).
   • NETWORK_NAME with the name of the VPC network.
   • REGION with the region that you want to create a Serverless VPC Access connector in.

Terraform

1. Create the VPC network to use.

   resource "google_compute_network" "default" {
     name = "cr-static-ip-network"
   }

   Replace cr-static-ip-network with the subnet name.

2. Create a subnet in the VPC for the Serverless VPC Access connector.

   resource "google_compute_subnetwork" "default" {
     name          = "cr-static-ip"
     ip_cidr_range = "10.124.0.0/28"
     network       = google_compute_network.default.id
     region        = "us-central1"
   }

   Replace the following:

   • cr-static-ip with your subnet name.
   • 10.124.0.0/28 with your CIDR range.
   • us-central1 with your Google Cloud region.

gcloud

1. Create a Serverless VPC Access connector with a pre-created subnet.

   gcloud compute networks vpc-access connectors create CONNECTOR_NAME \
     --region=REGION \
     --subnet-project=PROJECT_ID \
     --subnet=SUBNET_NAME

   Replace the following values in this command:

   • CONNECTOR with a name that you want to give to this resource.
   • PROJECT_ID with a name that hosts the subnet.
   • SUBNET_NAME with the name of the subnet that you created.
   • REGION with the region that you want to create a Cloud NAT gateway in.

Terraform

1. Create a Serverless VPC Access connector.

   resource "google_project_service" "vpc" {
     service            = "vpcaccess.googleapis.com"
     disable_on_destroy = false
   }
   
   resource "google_vpc_access_connector" "default" {
     name          = "cr-conn"
     region        = "us-central1"
     min_instances = 2
     max_instances = 3
   
     subnet {
       name = google_compute_subnetwork.default.name
     }
   
     # Wait for VPC API enablement
     # before creating this resource
     depends_on = [
       google_project_service.vpc
     ]
   }

   Replace cr-conn with the name of your Serverless VPC Access connector.

gcloud

1. Create a new Cloud Router to program a Cloud NAT gateway:

   gcloud compute routers create ROUTER_NAME \
     --network=NETWORK_NAME \
     --region=REGION

   Replace the following values in this command:

   • ROUTER_NAME with a name for the Cloud Router resource that you want to create.
   • NETWORK_NAME with the name of the VPC network that you found earlier.
   • REGION with the region that you want to create a Cloud NAT gateway in.

2. Reserve a static IP address. A reserved IP address resource retains the underlying IP address when the resource it is associated with is deleted and re-created:

   gcloud compute addresses create ORIGIN_IP_NAME --region=REGION

   Replace the following values in this command:

   • ORIGIN_IP_NAME with the name that you want to assign to the IP address resource.
   • REGION with the region that will run the Cloud NAT router. Use the same region as your Cloud Run service to minimize latency and network costs.

3. Create a Cloud NAT gateway configuration on this router to route the traffic originating from the VPC network using the static IP address that you created:

   gcloud compute routers nats create NAT_NAME \
     --router=ROUTER_NAME \
     --region=REGION \
     --nat-custom-subnet-ip-ranges=SUBNET_NAME \
     --nat-external-ip-pool=ORIGIN_IP_NAME

   Replace the following values in this command:

   • NAT_NAME with a name for the Cloud NAT gateway resource that you want to create.
   • ROUTER_NAME with the name of your Cloud Router.
   • REGION with the region that you want to create a Cloud NAT gateway in.
   • SUBNET_NAME with the name of your subnet.
   • ORIGIN_IP_NAME with the name of the reserved IP address resource that you created in the previous step.

Terraform

1. Create a new Cloud Router to program a Cloud NAT gateway:

   resource "google_compute_router" "default" {
     name    = "cr-static-ip-router"
     network = google_compute_network.default.name
     region  = google_compute_subnetwork.default.region
   }

   Replace cr-static-ip-router with your subnet name.

2. Reserve a static IP address. A reserved IP address resource retains the underlying IP address when the resource it is associated with is deleted and recreated:

   resource "google_compute_address" "default" {
     name   = "cr-static-ip-addr"
     region = google_compute_subnetwork.default.region
   }

   Replace cr-static-ip-addr with your subnet name.

3. Create a Cloud NAT gateway configuration on this router to route the traffic originating from the VPC network using the static IP address that you created:

   resource "google_compute_router_nat" "default" {
     name   = "cr-static-nat"
     router = google_compute_router.default.name
     region = google_compute_subnetwork.default.region
   
     nat_ip_allocate_option = "MANUAL_ONLY"
     nat_ips                = [google_compute_address.default.self_link]
   
     source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
     subnetwork {
       name                    = google_compute_subnetwork.default.id
       source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
     }
   }

   Replace cr-static-nat with your Cloud NAT gateway name.

gcloud

• Direct VPC egress

  To deploy or update your Cloud Run service to use Direct VPC egress and route all egress traffic through it, run the following command:

  gcloud run deploy SERVICE_NAME \
  --image=IMAGE_URL \
  --network=NETWORK \
  --subnet=SUBNET \
  --region=REGION \
  --vpc-egress=all-traffic

  Replace the following values in this command:

  • SERVICE_NAME with the name of the Cloud Run service that you want to deploy.
  • IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL has the shape LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG .
  • NETWORK with the name of your VPC network.
  • SUBNET with the name of your subnet.
  • REGION with a region for your service.

• Serverless VPC Access connector

  To deploy or update your Cloud Run service to use a Serverless VPC Access connector and route all egress traffic through it, run the following command:

  gcloud run deploy SERVICE_NAME \
  --image=IMAGE_URL \
  --vpc-connector=CONNECTOR_NAME \
  --region=REGION \
  --vpc-egress=all-traffic

  Replace the following values in this command:

  • SERVICE_NAME with the name of the Cloud Run service that you want to deploy.
  • IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL has the shape LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG .
  • CONNECTOR_NAME with the name of your Serverless VPC Access connector.
  • REGION with a region for your service.

Terraform

This Cloud Run service uses a VPC connector and routes all egress traffic through it:

resource "google_cloud_run_v2_service" "default" {
  name     = "cr-static-ip-service"
  location = google_compute_subnetwork.default.region

  deletion_protection = false # set to "true" in production

  template {
    containers {
      # Replace with the URL of your container
      #   gcr.io/<YOUR_GCP_PROJECT_ID>/<YOUR_CONTAINER_NAME>
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
    scaling {
      max_instance_count = 5
    }
    vpc_access {
      connector = google_vpc_access_connector.default.id
      egress    = "ALL_TRAFFIC"
    }
  }
  ingress = "INGRESS_TRAFFIC_ALL"

}

Replace us-docker.pkg.dev/cloudrun/container/hello with a reference to your container image.