Cloud Run Direct VPC egress explained

Summary

Direct VPC egress for Cloud Run simplifies VPC network access without serverless VPC connectors. It offers easier setup, faster performance, higher traffic capacity, and reduced costs. Key benefits include managing firewall rules, observability, and connecting to internal resources like Memorystore, Cloud SQL, and Compute Engine VMs. Direct VPC egress assigns internal IPs to Cloud Run instances, enabling outbound traffic only, ensuring security. It outperforms VPC connectors by eliminating extra hops, reducing latency, and offering pay-as-you-go network charges.

Takeaways

• 🚀 Direct VPC egress on Cloud Run allows traffic to be sent to a VPC network without a serverless VPC access connector.
• 🔧 It's easier to set up, faster, can handle more traffic, and has lower costs compared to traditional methods.
• 📍 Common use cases for sending traffic to VPC include managing firewall rules, network traffic observability, obtaining static IPs, and connecting to internal IP addresses.
• 💡 Resources that might require connection from Cloud Run include Memorystore instances, Cloud SQL instances without public IPs, Compute Engine VMs, and services with internal load balancers.
• 🌐 Enabling Direct VPC egress gives Cloud Run instances internal IP addresses on the VPC network, facilitating TCP/UDP egress.
• 🔒 The new interface acts as a firewall for Cloud Run instances, allowing only outbound connections and no inbound traffic from the VPC.
• 🌐 HTTPS web requests to Cloud Run are still routed to instances as before, unaffected by Direct VPC egress.
• 🤖 VPC connectors, in contrast, are a group of managed instances that proxy outbound connections, introducing an extra network hop.
• 💸 Direct VPC egress avoids the need for connector instances, resulting in pay-per-use network charges only, leading to cost savings.
• 🏎️ It offers a direct network path that is faster, can handle more traffic, and provides lower latency and higher throughput.
• 📝 To implement Direct VPC egress, configure network access for your Cloud Run service by checking 'Send traffic directly to a VPC'.