VPC with connectors

Console

1. Go to the Serverless VPC Access overview page.

   Go to Serverless VPC Access

2. Click Create connector.

3. In the Name field, enter a name for your connector, matching Compute Engine naming conventions, with the additional requirements that the name must be less than 21 characters long, and that hyphens (-) count as two characters.

4. In the Region field, select a region for your connector. This must match the region of your serverless service.

   If your service or job is in the region us-central or europe-west, use us-central1 or europe-west1.

5. In the Network field, select the VPC network to attach your connector to.

6. In the Subnet field, select one of the following options:

   • Create a connector using an existing subnet: Select the existing subnet in the Subnet field.

   • Create a connector and a new subnet: Select Custom IP range in the Subnet field. Then, enter the first address in an unused /28 CIDR (for example 10.8.0.0/28) to use as the primary IPv4 address range of a new subnet that Google Cloud creates in the connector's VPC network. Ensure that the IP range does not conflict with any existing routes in the connector's VPC network. The name of the new subnet begins with the "aet-" prefix.

7. (Optional) To set scaling options for additional control over the connector, click Show Scaling Settings to display the scaling form.

   1. Set the minimum and maximum number of instances for your connector, or use the defaults, which are 2 (min) and 10 (max). The connector scales up to the maximum specified if traffic usage requires it, but the connector does not scale back down when traffic decreases. You must use values between 2 and 10.
   2. In the Instance Type menu, choose the machine type to be used for the connector, or use the default e2-micro. Notice the cost sidebar on the right when you choose the instance type, which displays bandwidth and cost estimations.

8. Click Create.

9. A green check mark will appear next to the connector's name when it is ready to use.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. Update gcloud components to the latest version:

   gcloud components update

3. Ensure that the Serverless VPC Access API is enabled for your project:

   gcloud services enable vpcaccess.googleapis.com

4. Create the connector using one of the following options:

   For more details and optional arguments, see the gcloud reference.

   • Create a connector using an existing subnet:

     gcloud compute networks vpc-access connectors create CONNECTOR_NAME \
      --region REGION \
      --subnet SUBNET_NAME \
      --subnet-project HOST_PROJECT_ID \
      --min-instances MIN \
      --max-instances MAX \
      --machine-type MACHINE_TYPE

     Replace the following:

     • CONNECTOR_NAME: a name for your connector, matching Compute Engine naming conventions, with the additional requirements that the name must be less than 21 characters long, and that hyphens (-) count as two characters.
     • REGION: a region for your connector, matching the region of your serverless service or job. If your service or job is in us-central or europe-west, use us-central1 or europe-west1.
     • SUBNET_NAME: the name of the existing subnet.
     • HOST_PROJECT_ID: the Shared VPC host project ID. If the connector and existing subnet are located the same project, omit the --subnet-project flag.
     • MIN: the minimum number of instances to use for the connector. Use an integer between 2(the default) and 9.
     • MAX: the maximum number of instances to use for the connector. Use an integer between 3 and 10 (the default). If the connector scales up to the maximum number of instances, it does not scale back down.
     • MACHINE_TYPE: must be one of the following: f1-micro, e2-micro, or e2-standard-4.

   • Create a connector and a new subnet:

     gcloud compute networks vpc-access connectors create CONNECTOR_NAME \
      --region REGION \
      --network VPC_NETWORK \
      --range IP_RANGE
      --min-instances MIN \
      --max-instances MAX \
      --machine-type MACHINE_TYPE

     Replace the following:

     • CONNECTOR_NAME: a name for your connector, matching Compute Engine naming conventions, with the additional requirements that the name must be less than 21 characters long, and that hyphens (-) count as two characters.
     • REGION: a region for your connector, matching the region of your serverless service or job. If your service or job is in us-central or europe-west, use us-central1 or europe-west1.
     • VPC_NETWORK: the name of the VPC network to attach your connector to. The connector and VPC network must be located in the same project.
     • IP_RANGE: provide an unused /28 CIDR (for example 10.8.0.0/28) to use as the primary IPv4 address range of a new subnet that Google Cloud creates in the connector's VPC network. Ensure that the IP range does not conflict with any existing routes in the connector's VPC network. The name of the new subnet begins with the "aet-" prefix.
     • MIN: the minimum number of instances to use for the connector. Use an integer between 2(the default) and 9.
     • MAX: the maximum number of instances to use for the connector. Use an integer between 3 and 10 (the default). If the connector scales up to the maximum number of instances, it does not scale back down.
     • MACHINE_TYPE: must be one of the following: f1-micro, e2-micro, or e2-standard-4.

5. Verify that your connector is in the READY state before using it:

   gcloud compute networks vpc-access connectors describe CONNECTOR_NAME \
   --region REGION

   Replace the following:

   • CONNECTOR_NAME: the name of your connector; this is the name that you specified in the previous step.
   • REGION: the region of your connector; this is the region that you specified in the previous step.

   The output should contain the line state: READY.

Terraform

You can use a Terraform resource to enable the vpcaccess.googleapis.com API.

resource "google_project_service" "vpcaccess-api" {
  project = var.project_id # Replace this with your project ID in quotes
  service = "vpcaccess.googleapis.com"
}

You can use Terraform modules to create a VPC network and subnet and then create the connector.

module "test-vpc-module" {
  source       = "terraform-google-modules/network/google"
  version      = "~> 9.0"
  project_id   = var.project_id # Replace this with your project ID in quotes
  network_name = "my-serverless-network"
  mtu          = 1460

  subnets = [
    {
      subnet_name   = "serverless-subnet"
      subnet_ip     = "10.10.10.0/28"
      subnet_region = "us-central1"
    }
  ]
}

module "serverless-connector" {
  source     = "terraform-google-modules/network/google//modules/vpc-serverless-connector-beta"
  version    = "~> 9.0"
  project_id = var.project_id
  vpc_connectors = [{
    name        = "central-serverless"
    region      = "us-central1"
    subnet_name = module.test-vpc-module.subnets["us-central1/serverless-subnet"].name
    # host_project_id = var.host_project_id # Specify a host_project_id for shared VPC
    machine_type  = "e2-standard-4"
    min_instances = 2
    max_instances = 7
    }
    # Uncomment to specify an ip_cidr_range
    #   , {
    #     name          = "central-serverless2"
    #     region        = "us-central1"
    #     network       = module.test-vpc-module.network_name
    #     ip_cidr_range = "10.10.11.0/28"
    #     subnet_name   = null
    #     machine_type  = "e2-standard-4"
    #     min_instances = 2
    #   max_instances = 7 }
  ]
  depends_on = [
    google_project_service.vpcaccess-api
  ]
}

Console

1. In the Google Cloud console, go to Cloud Run:

   Go to Cloud Run

2. Click Deploy container and select Service to configure a new service. If you are configuring an existing service, click the service, then click Edit and deploy new revision.

3. If you are configuring a new service, fill out the initial service settings page, then click Container(s), volumes, networking, security to expand the service configuration page.

4. Click the Networking tab.

   

   • In the Network field, choose one of the following options from the menu:
     • To disconnect your service from a VPC network, select None.
     • To use an existing connector, select it from the drop-down list or select Custom to use an existing connector that's not shown in the drop-down list.
     • To create a new connector, select Add new VPC connector. See Create a Serverless VPC Access connector for details on creating a connector.
     • For Traffic routing, select one of the following:
       • Route only requests to private IPs to the VPC to send only traffic to internal addresses through the VPC network.
       • Route all traffic to the VPC to send all outbound traffic through the VPC network.

5. Click Create or Deploy.

gcloud

To specify a connector during deployment, use the --vpc-connector flag:

gcloud run deploy SERVICE --image IMAGE_URL --vpc-connector CONNECTOR_NAME

Replace:

• SERVICE with the name of your service.
• IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL has the shape LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG .
• CONNECTOR_NAME with the name of your connector.

To attach, update, or remove a connector for an existing service, use the gcloud run services update command with either of the following flags as needed:

• --vpc-connector
• --clear-vpc-connector

For example, to attach or update a connector:

gcloud run services update SERVICE --vpc-connector CONNECTOR_NAME

Replace:

• SERVICE with the name of your service.
• CONNECTOR_NAME with the name of your connector.

YAML

1. If you are creating a new service, skip this step. If you are updating an existing service, download its YAML configuration:

   gcloud run services describe SERVICE --format export > service.yaml

2. Add or update the run.googleapis.com/vpc-access-connector attribute under the annotations attribute under the top-level spec attribute:

   apiVersion: serving.knative.dev/v1
   kind: Service
   metadata:
     name: SERVICE
   spec:
     template:
       metadata:
         annotations:
           run.googleapis.com/vpc-access-connector: CONNECTOR_NAME
         name: REVISION

   Replace:

   • SERVICE with the name of your Cloud Run service.
   • CONNECTOR_NAME with the name of your connector.
   • REVISION with a new revision name or delete it (if present). If you supply a new revision name, it must meet the following criteria:
     • Starts with SERVICE-
     • Contains only lowercase letters, numbers and -
     • Does not end with a -
     • Does not exceed 63 characters

3. Create or update the service using the following command:

   gcloud run services replace service.yaml

Terraform

You can use a Terraform resource to create a service and configure it to use your connector.

# Cloud Run service
resource "google_cloud_run_v2_service" "gcr_service" {
  name     = "mygcrservice"
  location = "us-west1"

  deletion_protection = false # set to "true" in production

  template {
    containers {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
      resources {
        limits = {
          cpu    = "1000m"
          memory = "512Mi"
        }
      }
      # the service uses this SA to call other Google Cloud APIs
      # service_account_name = myservice_runtime_sa
    }

    scaling {
      # Limit scale up to prevent any cost blow outs!
      max_instance_count = 5
    }

    vpc_access {
      # Use the VPC Connector
      connector = google_vpc_access_connector.connector.id
      # all egress from the service should go through the VPC Connector
      egress = "ALL_TRAFFIC"
    }
  }
}

Console

1. In the Google Cloud console, go to the Cloud Run jobs page:

   Go to Cloud Run

2. Click Deploy container and select Job to fill out the initial job settings page. If you are configuring an existing job, select the job, then click Edit.

3. Click Container, variables and secrets, connections, security to expand the job properties page.

4. Click the Connections tab.

   

   • In the Network field, choose one of the following options from the menu:
     • To disconnect your job from a VPC network, select None.
     • To use an existing connector, select it from the drop-down list or select Custom to use an existing connector that's not shown in the drop-down list.
     • To create a new connector, select Add new VPC connector.
       See Create a Serverless VPC Access connector for details on creating a connector.

5. Click Create or Update.

gcloud

To specify a connector during the job deployment, use the --vpc-connector flag:

gcloud run jobs create JOB --image IMAGE_URL --vpc-connector CONNECTOR_NAME

Replace:

• JOB with the name of your job.
• IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL has the shape LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG .
• CONNECTOR_NAME with the name of your connector.

To attach, update, or remove a connector for an existing service, use the gcloud run jobs update command with either of the following flags as needed:

• --vpc-connector
• --clear-vpc-connector

For example, to attach or update a connector:

gcloud run jobs update JOB --vpc-connector CONNECTOR_NAME

Replace:

• JOB with the name of your job.
• CONNECTOR_NAME with the name of your connector.

YAML

You can download and view an existing job configuration by using the gcloud run jobs describe --format export command, which yields cleaned results in YAML format. You can then modify the fields described below and upload the modified YAML by using the gcloud run jobs replace command. Make sure you only modify fields as documented.

1. To view and download the configuration:

   gcloud run jobs describe JOB --format export > job.yaml

2. Add or update the run.googleapis.com/vpc-access-connector attribute under the annotations attribute under the top-level spec attribute:

   apiVersion: serving.knative.dev/v1
     kind: Job
     metadata:
       name: JOB
     spec:
       template:
         metadata:
           annotations:
             run.googleapis.com/vpc-access-connector: CONNECTOR_NAME

   Replace:

   • JOB with the name of your Cloud Run job.
   • CONNECTOR_NAME with the name of your connector. The run.googleapis.com/vpc-access-connector attribute is required when specifying an egress setting.

3. Replace the job with its new configuration by using the following command:

   gcloud run jobs replace job.yaml

Network tags

The following steps show how to create ingress rules that restrict a connector's access to your VPC network based on the connector network tags.

1. Ensure that you have the required permissions to insert firewall rules. You must have one of the following Identity and Access Management (IAM) roles:

   • Compute Security Admin role
   • Custom IAM role with the compute.firewalls.create permission enabled

2. Deny connector traffic across your VPC network.

   Create an ingress firewall rule with priority lower than 1000 on your VPC network to deny ingress from the connector network tag. This overrides the implicit firewall rule that Serverless VPC Access creates on your VPC network by default.

   gcloud compute firewall-rules create RULE_NAME \
   --action=DENY \
   --rules=PROTOCOL \
   --source-tags=VPC_CONNECTOR_NETWORK_TAG \
   --direction=INGRESS \
   --network=VPC_NETWORK \
   --priority=PRIORITY

   Replace the following:

   • RULE_NAME: the name of your new firewall rule. For example, deny-vpc-connector.

   • PROTOCOL: one or more protocols that you want to allow from your VPC connector. Supported protocols are tcp or udp. For example, tcp:80,udp allows TCP traffic through port 80 and UDP traffic. For more information, see the documentation for the allow flag.

     For security and validation purposes, you can also configure deny rules to block traffic for the following unsupported protocols: ah, all, esp, icmp, ipip, and sctp.

   • VPC_CONNECTOR_NETWORK_TAG: the universal connector network tag if you want to restrict access for all connectors (including any connectors made in the future), or the unique network tag if you want to restrict access for a specific connector.

     • Universal network tag: vpc-connector

     • Unique network tag: vpc-connector-REGION-CONNECTOR_NAME

       Replace:

       • REGION: the region of the connector that you want to restrict
       • CONNECTOR_NAME: the name of the connector that you want to restrict

     To learn more about connector network tags, see Network tags.

   • VPC_NETWORK: the name of your VPC network

   • PRIORITY: an integer between 0-65535. For example, 0 sets the highest priority.

3. Allow connector traffic to the resource that should receive connector traffic.

   Use the allow and target-tags flags to create an ingress firewall rule targeting the resource in your VPC network that you want the VPC connector to access. Set the priority for this rule to be a lower value than the priority of the rule you made in the previous step.

   gcloud compute firewall-rules create RULE_NAME \
   --allow=PROTOCOL \
   --source-tags=VPC_CONNECTOR_NETWORK_TAG \
   --direction=INGRESS \
   --network=VPC_NETWORK \
   --target-tags=RESOURCE_TAG \
   --priority=PRIORITY

   Replace the following:

   • RULE_NAME: the name of your new firewall rule. For example, allow-vpc-connector-for-select-resources.

   • PROTOCOL: one or more protocols that you want to allow from your VPC connector. Supported protocols are tcp or udp. For example, tcp:80,udp allows TCP traffic through port 80 and UDP traffic. For more information, see the documentation for the allow flag.

   • VPC_CONNECTOR_NETWORK_TAG: the universal connector network tag if you want to restrict access for all connectors (including any connectors made in the future), or the unique network tag if you want to restrict access for a specific connector. This must match the network tag that you specified in the previous step.

     • Universal network tag: vpc-connector

     • Unique network tag: vpc-connector-REGION-CONNECTOR_NAME

       Replace:

       • REGION: the region of the connector that you want to restrict
       • CONNECTOR_NAME: the name of the connector that you want to restrict

     To learn more about connector network tags, see Network tags.

   • VPC_NETWORK: the name of your VPC network

   • RESOURCE_TAG: the network tag for the VPC resource that you want your VPC connector to access

   • PRIORITY: an integer less than the priority you set in the previous step. For example, if you set the priority for the rule you created in the previous step to 990, try 980.

For more information about the required and optional flags for creating firewall rules, refer to the documentation for gcloud compute firewall-rules create.

CIDR range

The following steps show how to create ingress rules that restrict a connector's access to your VPC network based on the connector's CIDR range.

1. Ensure that you have the required permissions to insert firewall rules. You must have one of the following Identity and Access Management (IAM) roles:

   • Compute Security Admin role
   • Custom IAM role with the compute.firewalls.create permission enabled

2. Deny connector traffic across your VPC network.

   Create an ingress firewall rule with priority lower than 1000 on your VPC network to deny ingress from the connector's CIDR range. This overrides the implicit firewall rule that Serverless VPC Access creates on your VPC network by default.

   gcloud compute firewall-rules create RULE_NAME \
   --action=DENY \
   --rules=PROTOCOL \
   --source-ranges=VPC_CONNECTOR_CIDR_RANGE \
   --direction=INGRESS \
   --network=VPC_NETWORK \
   --priority=PRIORITY

   Replace the following:

   • RULE_NAME: the name of your new firewall rule. For example, deny-vpc-connector.

   • PROTOCOL: one or more protocols that you want to allow from your VPC connector. Supported protocols are tcp or udp. For example, tcp:80,udp allows TCP traffic through port 80 and UDP traffic. For more information, see the documentation for the allow flag.

     For security and validation purposes, you can also configure deny rules to block traffic for the following unsupported protocols: ah, all, esp, icmp, ipip, and sctp.

   • VPC_CONNECTOR_CIDR_RANGE: the CIDR range for the connector whose access you are restricting

   • VPC_NETWORK: the name of your VPC network

   • PRIORITY: an integer between 0-65535. For example, 0 sets the highest priority.

3. Allow connector traffic to the resource that should receive connector traffic.

   Use the allow and target-tags flags to create an ingress firewall rule targeting the resource in your VPC network that you want the VPC connector to access. Set the priority for this rule to be a lower value than the priority of the rule you made in the previous step.

   gcloud compute firewall-rules create RULE_NAME \
   --allow=PROTOCOL \
   --source-ranges=VPC_CONNECTOR_CIDR_RANGE \
   --direction=INGRESS \
   --network=VPC_NETWORK \
   --target-tags=RESOURCE_TAG \
   --priority=PRIORITY

   Replace the following:

   • RULE_NAME: the name of your new firewall rule. For example, allow-vpc-connector-for-select-resources.

   • PROTOCOL: one or more protocols that you want to allow from your VPC connector. Supported protocols are tcp or udp. For example, tcp:80,udp allows TCP traffic through port 80 and UDP traffic. For more information, see the documentation for the allow flag.

   • VPC_CONNECTOR_CIDR_RANGE: the CIDR range for the connector you whose access you are restricting

   • VPC_NETWORK: the name of your VPC network

   • RESOURCE_TAG: the network tag for the VPC resource that you want your VPC connector to access

   • PRIORITY: an integer less than the priority you set in the previous step. For example, if you set the priority for the rule you created in the previous step to 990, try 980.

For more information about the required and optional flags for creating firewall rules, see the documentation for gcloud compute firewall-rules create.

Console

1. In the Google Cloud console, go to Cloud Run:

   Go to Cloud Run

2. Click Deploy container and select Service to configure a new service. If you are configuring an existing service, click the service, then click Edit and deploy new revision.

3. If you are configuring a new service, fill out the initial service settings page, then click Container(s), volumes, networking, security to expand the service configuration page.

4. Click the Networking tab.

   

   • After you select a VPC connector, select Route only requests to private IPs to the VPC or Route all traffic to the VPC.

5. Click Create or Deploy.

gcloud

To specify an egress setting, use the --vpc-egress flag. You can specify an egress setting during deployment:

gcloud run deploy SERVICE \
--image IMAGE_URL \
--vpc-connector CONNECTOR_NAME \
--vpc-egress EGRESS_SETTING

Replace:

• SERVICE with the name of your service.
• IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL has the shape LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG .
• CONNECTOR_NAME with the name of your connector.
• EGRESS_SETTING with an egress setting value:
  • all-traffic: Sends all outbound traffic through the connector.
  • private-ranges-only: Sends only traffic to internal addresses through the VPC connector.

You can also update an existing service and change the egress setting:

gcloud run services update SERVICE --vpc-egress EGRESS_SETTING

Replace:

• SERVICE with the name of your service.
• EGRESS_SETTING with an egress setting value as listed above.

YAML

1. If you are creating a new service, skip this step. If you are updating an existing service, download its YAML configuration:

   gcloud run services describe SERVICE --format export > service.yaml

2. Add or update the run.googleapis.com/vpc-access-egress attribute under the annotations attribute under the top-level spec attribute:

   apiVersion: serving.knative.dev/v1
   kind: Service
   metadata:
     name: SERVICE
   spec:
     template:
       metadata:
         annotations:
           run.googleapis.com/vpc-access-connector: CONNECTOR_NAME
           run.googleapis.com/vpc-access-egress: EGRESS_SETTING
         name: REVISION

   Replace:

   • SERVICE with the name of your Cloud Run service.
   • CONNECTOR_NAME with the name of your connector. The run.googleapis.com/vpc-access-connector attribute is required when specifying an egress setting.
   • EGRESS_SETTING with one of the following:
     • all-traffic: Sends all outbound traffic through the connector.
     • private-ranges-only: Sends only traffic to internal addresses through the VPC connector.
     • REVISION with a new revision name or delete it (if present). If you supply a new revision name, it must meet the following criteria:
       • Starts with SERVICE-
       • Contains only lowercase letters, numbers and -
       • Does not end with a -
       • Does not exceed 63 characters

3. Create or update the service using the following command:

   gcloud run services replace service.yaml

Console

1. In the Google Cloud console, go to the Cloud Run jobs page:

   Go to Cloud Run

2. Click Deploy container and select Job to fill out the initial job settings page. If you are configuring an existing job, select the job, then click Edit.

3. Click Container, variables and secrets, connections, security to expand the job properties page.

4. Click the Connections tab.

   

   • After you select a connector, select Route only requests to private IPs to the VPC or Route all traffic to the VPC.

5. Click Create or Update.

gcloud

To specify an egress setting, use the --vpc-egress flag. You can specify an egress setting during the job deployment process:

gcloud run jobs create JOB \
--image IMAGE_URL \
--vpc-connector CONNECTOR_NAME \
--vpc-egress EGRESS_SETTING

Replace:

• JOB with the name of your job.
• IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL has the shape LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG .
• CONNECTOR_NAME with the name of your connector.
• EGRESS_SETTING with an egress setting value:
  • all-traffic: Sends all outbound traffic through the connector.
  • private-ranges-only: Sends only traffic to internal addresses through the VPC connector.

You can also update an existing job and change the egress setting:

gcloud run jobs update JOB --vpc-egress EGRESS_SETTING

Replace:

• JOB with the name of your job.
• EGRESS_SETTING with an egress setting value as listed above.

YAML

You can download and view an existing job configuration by using the gcloud run jobs describe --format export command, which yields cleaned results in YAML format. You can then modify the fields described below and upload the modified YAML by using the gcloud run jobs replace command. Make sure you only modify fields as documented.

1. Replace the job with its new configuration by using the following command:

   gcloud run jobs replace job.yaml

2. Add or update the run.googleapis.com/vpc-access-egress attribute under the annotations attribute under the top-level spec attribute:

   apiVersion: serving.knative.dev/v1
     kind: Job
     metadata:
       name: JOB
     spec:
       template:
         metadata:
           annotations:
             run.googleapis.com/vpc-access-connector: CONNECTOR_NAME
             run.googleapis.com/vpc-access-egress: EGRESS_SETTING

   Replace:

   • JOB with the name of your Cloud Run job.
   • CONNECTOR_NAME with the name of your connector. The run.googleapis.com/vpc-access-connector attribute is required when specifying an egress setting.
   • EGRESS_SETTING with one of the following:
     • all-traffic: Sends all outbound traffic through the connector.
     • private-ranges-only: Sends only traffic to internal addresses through the VPC connector.

3. Replace the job with its new configuration by using the following command:

   gcloud run jobs replace job.yaml

Console

1. Go to Cloud Run

2. Click the service or job you are interested in to open the details page.

   • For a service, click the Revisions tab.

   • For a job, click the Configuration tab.

The Serverless VPC Access connector setting is listed under the Networking tab.

gcloud

1. Use the following command to view settings for your service:

   gcloud run services describe SERVICE

2. Use the following command to view settings for your job:

   gcloud run jobs describe JOB

3. Locate the Serverless VPC Access connector setting in the returned configuration.

Console

1. In the Google Cloud console, go to Cloud Run:

   Go to Cloud Run

2. Click Deploy container and select Service to configure a new service. If you are configuring an existing service, click the service, then click Edit and deploy new revision.

3. If you are configuring a new service, fill out the initial service settings page, then click Container(s), volumes, networking, security to expand the service configuration page.

4. Click the Networking tab.

   

   • In the Network field, select None to disconnect your service from a VPC network.

5. Click Create or Deploy.

gcloud

To disconnect a service, use the gcloud run services update command with the following flag:

• --clear-vpc-connector

gcloud run services update SERVICE --clear-vpc-connector

• Replace SERVICE with the name of your service.

Console

1. In the Google Cloud console, go to the Cloud Run jobs page:

   Go to Cloud Run

2. Click Deploy container and select Job to fill out the initial job settings page. If you are configuring an existing job, select the job, then click Edit.

3. Click Container, variables and secrets, connections, security to expand the job properties page.

4. Click the Connections tab.

   

   • In the Network field, select None to disconnect your job from a VPC network.

5. Click Create or Update.

gcloud

To disconnect a job, use the gcloud run jobs update command with the following flag:

--clear-vpc-connector

gcloud run jobs update JOB --clear-vpc-connector

Replace JOB with the name of your job.

Console

1. Go to the Serverless VPC Access overview page.

   Go to Serverless VPC Access

2. Select the connector you want to edit and click Edit.

3. In the Instance type list, select your preferred machine (instance) type. To learn about available machine types, see the documentation on Throughput and scaling.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To update the connector machine type, run the following command in your terminal:

   gcloud beta compute networks vpc-access connectors update CONNECTOR_NAME --region=REGION --machine-type=MACHINE_TYPE

   Replace the following:
   • CONNECTOR_NAME: the name of your connector
   • REGION: the name of your connector's region
   • MACHINE_TYPE: your preferred machine type. To learn about available machine types, see the documentation on Throughput and scaling.

Console

1. Go to the Serverless VPC Access overview page.

   Go to Serverless VPC Access

2. Select the connector you want to edit and click Edit.

3. In the Minimum instances field, select your preferred minimum number of instances.

   The smallest possible value for this field is the current value. The largest possible value for this field is the current value in the Maximum instances field minus 1. For example, if the value in the Maximum instances field is 8, then the largest possible value for the Minimum instances field is 7.

4. In the Maximum instances field, select your preferred maximum number of instances.

   The smallest possible value for this field is the current value. The largest possible value for this field is 10.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To increase the minimum or maximum number of instances for the connector, run the following command in your terminal:

   gcloud beta compute networks vpc-access connectors update CONNECTOR_NAME --region=REGION --min-instances=MIN_INSTANCES --max-instances=MAX_INSTANCES

   Replace the following:

• CONNECTOR_NAME: the name of your connector
• REGION: the name of your connector's region
• MIN_INSTANCES: your preferred minimum number of instances.
  • Smallest possible value for this field is the current value of min_instances. To find the current value, see Find the current attribute values.
  • Largest possible value for this field is the current max_instances value minus 1, because min_instances must be less than max_instances. For example, if max_instances is 8, the largest possible value for this field is 7. If your connector uses the default max-instances value of 10, the largest possible value of this field is 9. To find the value of max-instances, see Find the current attribute values.

• MAX_INSTANCES:

  • Smallest possible value for this field is the current value of max_instances. To find the current value, see Find the current attribute values.
  • Largest possible value for this field is 10.

  If you only want to increase the minimum number of instances but not the maximum, you must still specify the maximum number of instances. Conversely, if you only want to update the maximum number of instances but not the minimum, you must still specify the minimum number of instances. To keep either the minimum or maximum number of instances at their current value, specify their current value. To find their current value, see Find the current attribute values.

Console

1. Go to the Serverless VPC Access overview page in the Google Cloud console:

   Go to Serverless VPC Access

2. Select the connector you want to delete.

3. Click Delete.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. Use the following gcloud command to delete a connector:

   gcloud compute networks vpc-access connectors delete CONNECTOR_NAME --region=REGION
   

   Replace the following:

   • CONNECTOR_NAME with the name of the connector you want to delete
   • REGION with the region where the connector is located