Direct VPC egress with a VPC network

Console

1. Go to Cloud Run

2. Click Create Service if you are configuring a new service you are deploying to. If you are configuring and deploying an existing service, click the service, then click Edit and deploy new revision.

3. If you are configuring a new service, fill out the initial service settings page as needed, then click Container(s), volumes, networking, security to expand the service configuration page.

4. Click the Networking tab.

5. Click Connect to a VPC for outbound traffic.

6. Click Send traffic directly to a VPC.

7. In the Network field, select the VPC network that you want to send traffic to.

8. In the Subnet field, select the subnet where your service receives IP addresses from. You can deploy multiple services on the same subnet.

9. Optional: Enter the names of the network tags that you want to associate with your service or services. Network tags are specified at the revision-level. Each service revision can have different network tags, such as network-tag-2.

10. For Traffic routing, select one of the following:

    • Route only requests to private IPs to the VPC to send only traffic to internal addresses through the VPC network.
    • Route all traffic to the VPC to send all outbound traffic through the VPC network.

11. Click Create or Deploy.

12. To verify that your service is on your VPC network, click the service, then click the Networking tab. The network and subnet are listed in the VPC card.

    You can now send requests from your Cloud Run service to any resource on the VPC network, as allowed by your firewall rules.

gcloud

To deploy a Cloud Run service without a connector from the Google Cloud CLI:

1. Update gcloud components to the latest version:

   gcloud components update

2. Ensure that the Compute Engine API is enabled for your project:

   gcloud services enable compute.googleapis.com
   

3. Deploy your Cloud Run service with the following command:

   gcloud run deploy SERVICE_NAME \
   --image=IMAGE_URL \
   --network=NETWORK \
   --subnet=SUBNET \
   --network-tags=NETWORK_TAG_NAMES \
   --vpc-egress=EGRESS_SETTING \
   --region=REGION

   Replace:

   • SERVICE_NAME with the name of your Cloud Run service.
   • IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL has the shape LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG
   • NETWORK with the name of your VPC network.
   • SUBNET with the name of your subnet. You can deploy or execute multiple services or jobs on the same subnet.
   • Optional: NETWORK_TAG_NAMES with the comma-separated names of the network tags you want to associate with a service. For services, network tags are specified at the revision-level. Each service revision can have different network tags, such as network-tag-2.
   • EGRESS_SETTING with an egress setting value:
     • all-traffic: Sends all outbound traffic through the VPC network.
     • private-ranges-only: Sends only traffic to internal addresses through the VPC network.
   • REGION with a region for your service.

4. To verify that your service is on your VPC network, run the following command:

   gcloud run services describe SERVICE_NAME \
   --region=REGION

   Replace:

   • SERVICE_NAME with the name of your service.
   • REGION with the region for your service that you specified in the previous step.

   The output should contain the name of your network, subnet, and egress setting, for example:

   VPC access:
     Network:       default
     Subnet:        subnet
     Egress:        private-ranges-only
   

You can now send requests from your Cloud Run service to any resource on the VPC network, as allowed by your firewall rules.

YAML

1. If you are creating a new service, skip this step. If you are updating an existing service, download its YAML configuration:

   gcloud run services describe SERVICE --format export > service.yaml

2. Update the following attributes:

   apiVersion: serving.knative.dev/v1
     kind: Service
     metadata:
       name: SERVICE_NAME
       labels:
         cloud.googleapis.com/location: REGION
     spec:
       template:
         metadata:
           annotations:
             run.googleapis.com/network-interfaces: '[{"network":"NETWORK","subnetwork":"SUBNET","tags":"NETWORK_TAG_NAMES"}]'
             run.googleapis.com/vpc-access-egress: EGRESS_SETTING
         spec:
           containers:
           - image: IMAGE

   Replace:

   • SERVICE_NAME with the name of your Cloud Run service. Service names must be 49 characters or less and must be unique per region and project.
   • REGION with the region for your Cloud Run service, which must match the region of your subnet.
   • NETWORK with the name of your VPC network.
   • SUBNET with the name of your subnet. You can deploy or execute multiple services or jobs on the same subnet.
   • Optional: NETWORK_TAG_NAMES with the names of the network tags you want to associate with a service. For services, network tags are specified at the revision-level. Each service revision can have different network tags, such as network-tag-2.
   • EGRESS_SETTING with an egress setting value:
     • all-traffic: Sends all outbound traffic through the VPC network.
     • private-ranges-only: Sends only traffic to internal addresses through the VPC network.
   • IMAGE with the URL of your service container image.

   You can also specify more configuration, such as environment variables or memory limits.

3. Create or update the service using the following command:

   gcloud run services replace service.yaml

Terraform

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

1. Add the following to your main.tf file:

   /**
    * Copyright 2024 Google LLC
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *      http://www.apache.org/licenses/LICENSE-2.0
    *
    * Unless required by applicable law or agreed to in writing, software
    * distributed under the License is distributed on an "AS IS" BASIS,
    * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    * See the License for the specific language governing permissions and
    * limitations under the License.
    */
   
   # Example configuration of a Cloud Run service with direct VPC
   
   resource "google_cloud_run_v2_service" "default" {
     name     = "cloudrun-service"
     location = "us-central1"
   
     deletion_protection = false # set to "true" in production
   
     template {
       containers {
         image = "us-docker.pkg.dev/cloudrun/container/hello"
       }
       vpc_access {
         network_interfaces {
           network    = "default"
           subnetwork = "default"
           tags       = ["tag1", "tag2", "tag3"]
         }
       }
     }
   }
   

Console

1. Go to Cloud Run

2. If you are configuring a new job, click the Jobs tab and fill out the initial job settings page as needed. If you are configuring an existing job, click the job, then click Edit.

3. Click Container, Variables & Secrets, Connections, Security to expand the job properties page.

4. Click the Connections tab.

5. Click Connect to a VPC for outbound traffic.

6. Click Send traffic directly to a VPC.

7. In the Network field, select the VPC network that you want to send traffic to.

8. In the Subnet field, select the subnet where your job receives IP addresses from. You can execute multiple jobs on the same subnet.

9. For Traffic routing, select one of the following:

   • Route only requests to private IPs to the VPC to send only traffic to internal addresses through the VPC network.
   • Route all traffic to the VPC to send all outbound traffic through the VPC network.

10. Optional: Enter the names of the network tags that you want to associate with your service or services. Network tags are specified at the revision-level. Each service revision can have different network tags, such as network-tag-2.

11. Optional: Enter the names of the network tags that you want to associate with your job or jobs. For jobs, network tags are specified at the execution level. Each job execution can have different network tags, such as network-tag-2.

12. Click Create or Update.

13. To verify that your job is on your VPC network, click the job, then click the Configuration tab. The network and subnet are listed in the VPC card.

    You can now execute your Cloud Run job and send requests from the job to any resource on the VPC network, as allowed by your firewall rules.

gcloud

To create a Cloud Run job without a connector from the Google Cloud CLI:

1. Update gcloud components to the latest version:

   gcloud components update

2. Ensure that the Compute Engine API is enabled for your project:

   gcloud services enable compute.googleapis.com
   

3. Create a Cloud Run job with the following command:

   gcloud run jobs create JOB_NAME \
   --image=IMAGE_URL \
   --network=NETWORK \
   --subnet=SUBNET \
   --network-tags=NETWORK_TAG_NAMES \
   --vpc-egress=EGRESS_SETTING \
   --region=REGION

   Replace:

   • JOB_NAME with the name of your Cloud Run job.
   • IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/job:latest
   • NETWORK with the name of your VPC network.
   • SUBNET with the name of your subnet. You can deploy or execute multiple services or jobs on the same subnet.
   • Optional: NETWORK_TAG_NAMES with the names of the network tags you want to associate with a job. For jobs, network tags are specified at the execution-level. Each job execution can have different network tags, such as network-tag-2.
   • EGRESS_SETTING with an egress setting value:
     • all-traffic: Sends all outbound traffic through the VPC network.
     • private-ranges-only: Sends only traffic to internal addresses through the VPC network.
   • REGION with a region for your job.

4. To verify that the job is on your VPC network, run the following command:

   gcloud run jobs describe JOB_NAME \
     --region=REGION
     

   Replace:

   • JOB_NAME with the name of your job.
   • REGION with the region for your job that you specified in the previous step.

   The output should contain the name of your network and subnet, for example:

   VPC network:
     Network:       default
     Subnet:        default
   

You can now execute your Cloud Run job and send requests from the job to any resource on the VPC network, as allowed by your firewall rules.

YAML

1. If you are creating a new job, skip this step. If you are updating an existing job, download its YAML configuration:

   gcloud run jobs describe JOB_NAME --format export > job.yaml

2. Update the following attributes:

   apiVersion: run.googleapis.com/v1
     kind: Job
     metadata:
       name: JOB_NAME
       annotations:
         run.googleapis.com/launch-stage: BETA
       labels:
         cloud.googleapis.com/location: REGION
     spec:
       template:
         metadata:
           annotations:
             run.googleapis.com/network-interfaces: '[{"network":"NETWORK","subnetwork":"SUBNET","tags":"NETWORK_TAG_NAMES"}]'
             run.googleapis.com/vpc-access-egress: EGRESS_SETTING
         spec:
           containers:
           - image: IMAGE

   Replace:

   • JOB_NAME with the name of your Cloud Run job. Job names must be 49 characters or less and must be unique per region and project.
   • REGION with the region for your Cloud Run job, which must match the region of your subnet.
   • NETWORK with the name of your VPC network.
   • SUBNET with the name of your subnet. You can deploy or execute multiple services or jobs on the same subnet.
   • Optional: NETWORK_TAG_NAMES with the names of the network tags you want to associate with a job. For jobs, network tags are specified at the execution-level. Each job execution can have different network tags, such as network-tag-2.
   • EGRESS_SETTING with an egress setting value:
     • all-traffic: Sends all outbound traffic through the VPC network.
     • private-ranges-only: Sends only traffic to internal addresses through the VPC network.
   • IMAGE with the URL of your job container image.

3. Create or update the job using the following command:

   gcloud run jobs replace job.yaml

Console

To associate network tags with a service or job:

1. In the Google Cloud console, go to the Cloud Run page.

   Go to Cloud Run

2. Click the service or job you want to associate network tags with, then click Edit and deploy new revision for services or Edit for jobs.

3. Click the Networking tab for services, or the Connections tab for jobs.

4. Ensure that you have selected Connect to a VPC for outbound traffic and Send traffic directly to a VPC.

5. In the Subnet field, select the subnet where your service receives IP addresses from. You can deploy or execute multiple services or jobs on the same subnet.

6. In the Network tags field, enter the names of the network tags that you want to associate with your service or job.

7. Click Deploy or Update.

For services, every service revision can have a different set of network tags because network tags are specified at the revision level. For jobs, a job execution has the same network tags that the job had when the execution of the job was created.

gcloud

To associate network tags with a service or job, use the gcloud run deploy command:

gcloud run deploy SERVICE_JOB_NAME \
    --image=IMAGE_URL \
    --network=NETWORK \
    --subnet=SUBNET \
    --network-tags=NETWORK_TAG_NAMES \
    --region=REGION

Replace the following:

• SERVICE_JOB_NAME with the name of your service or job.
• IMAGE_URL with the image URL of the service or job.
• NETWORK with the name of your VPC network.
• SUBNET with the name of your subnet. You can deploy or execute multiple services or jobs on the same subnet.
• NETWORK_TAG_NAMES with the name of your network tag or a comma-separated list of network tags.
• REGION with the name of your region.

For services, every service revision can have a different set of network tags because network tags are specified at the revision level. For jobs, a job execution has the same network tags that the job had when the execution of the job was created.

Console

• To remove your service from the VPC network:

  1. Go to Cloud Run

  2. Click the service you want to remove, then click Edit and deploy new revision.

  3. Click the Networking tab.

  4. Clear Connect to a VPC for outbound traffic.

  5. Click Deploy.

  6. To verify that your service is no longer on your VPC network, click the Networking tab. The network and subnet are no longer listed in the VPC card.

• To remove only the network tags while keeping the service connected to the VPC network:

  1. Click the service that contains the network tags you want to remove, then click Edit and deploy new revision.

  2. Click the Networking tab.

  3. Clear the names of the network tags that you no longer want to associate with your service.

  4. Click Deploy.

gcloud

• To remove your service from the VPC network, run the following command:

  gcloud run services update SERVICE_NAME --region=REGION \
  --clear-network

• To remove only the network tags while keeping the service connected to the VPC network, run the following command:

  gcloud run services update SERVICE_NAME --region=REGION \
  --clear-network-tags

  Replace the following:

  • SERVICE_NAME: the name of your Cloud Run service.
  • REGION: the region for your Cloud Run service.

YAML

• To remove your service from the VPC network:

  1. Download the service's YAML configuration:

     gcloud run services describe SERVICE_NAME --format export > service.yaml

  2. Remove the following content from your service.yaml file:

     run.googleapis.com/network-interfaces: '[{"network":"NETWORK","subnetwork":"SUBNET","tags":"NETWORK_TAG_NAMES"}]'

     Where

     • NETWORK: the name of your VPC network.
     • SUBNET: the name of your subnet.
     • Optional: NETWORK_TAG_NAMES: the names of the network tags if you had associated them with a service.

  3. Deploy the service revision by running the following command:

     gcloud run services replace service.yaml

• To remove only the network tags while keeping the service connected to the VPC network:

  1. Download the service's YAML configuration:

     gcloud run services describe SERVICE_NAME --format export > service.yaml

  2. Remove the tags variable from the content in your service.yaml file, leaving the network and subnetwork variables in place, as shown in the following example:

     run.googleapis.com/network-interfaces: '[{"network":"NETWORK","subnetwork":"SUBNET"}]'

     Where

     • NETWORK: the name of your VPC network.
     • SUBNET: the name of your subnet.

  3. Deploy the service revision by running the following command:

     gcloud run services replace service.yaml

Console

• To remove your job from the VPC network:

  1. Go to Cloud Run

  2. Click the job you want to remove, then click Edit and deploy new revision.

  3. Click the Connections tab.

  4. Clear Connect to a VPC for outbound traffic.

  5. Click Update.

  6. To verify that your job is no longer on your VPC network, click the Configuration tab. The network and subnet are no longer listed in the VPC card.

• To remove only the network tags while keeping the job connected to the VPC network:

  1. Click the job that contains the network tags you want to remove, then click Edit and deploy new revision.

  2. Click the Connections tab.

  3. Clear the names of the network tags that you no longer want to associate with your job.

  4. Click Update.

gcloud

• To remove your job from the VPC network, run the following command:

  gcloud run jobs update JOB_NAME --region=REGION \
    --clear-network
    

• To remove only the network tags while keeping the job connected to the VPC network, run the following command:

  gcloud run jobs update JOB_NAME --region=REGION \
    --clear-network-tags
    

  Replace the following:

  • JOB_NAME: the name of your Cloud Run job.
  • REGION: the region for your Cloud Run job.

YAML

• To remove your job from the VPC network:

  1. Download the job's YAML configuration:

     gcloud run jobs describe JOB_NAME --format export > job.yaml

  2. Remove the following content from your job.yaml file:

     run.googleapis.com/network-interfaces: '[{"network":"NETWORK","subnetwork":"SUBNET","tags":"NETWORK_TAG_NAMES"}]'

     Replace the following:

     • NETWORK: the name of your VPC network.
     • SUBNET: the name of your subnet.
     • Optional: NETWORK_TAG_NAMES with the names of the network tags if you had associated them with a job.

  3. Update the job by running the following command:

     gcloud run jobs replace job.yaml

• To remove only the network tags while keeping the job connected to the VPC network:

  1. Download the job's YAML configuration:

     gcloud run jobs describe JOB_NAME --format export > job.yaml

  2. Remove the tags variable from the content in your job.yaml file, leaving the network and subnetwork variables in place, as shown in the following example:

     run.googleapis.com/network-interfaces: '[{"network":"NETWORK","subnetwork":"SUBNET"}]'

     Replace the following:

     • NETWORK: the name of your VPC network.
     • SUBNET: the name of your subnet.

  3. Update the job by running the following command:

     gcloud run jobs replace job.yaml