Cloud run egress traffic to internet

Google Cloud Serverless Applications
1

Hi everyone!!

I’m working with cloud run services and I have a problem with egress traffic to internet when cloud run service has configured a Serverless VPC Access Connector.

Cloud run Service is configured as follow:

  1. Ingress: Allow internal traffic and traffic from Cloud Load Balancing
  2. VPC Connector: Route all traffic through the VPC connector
  3. Cloud run service is behind a External Global Load Balancer.

After configure the connector the service couldn’t access to external service like Facebook for example.

I checked documentation and I found: https://cloud.google.com/run/docs/configuring/static-outbound-ip, but I understand this feature allow us set an outbound static ip, if for some reason an external service require a static ip.

How I can solve for cloud run service the egress traffic to internet when connector is configured as it is??

Thanks in advance!

2

Hi Paul, you have two options:

  1. Configure Egress to route only private IPs through the VPC connector. This is the easiest way and works well if you don’t need to use VPC SC and don’t need to call other Cloud Run services that have Ingress=internal.

  2. Use Cloud NAT, following the documentation you found. Once your request is in the VPC Network, Cloud NAT is the way to get it routed out of the network, even if you don’t need a static outbound IP.

3

Thanks knet,

Actually, my cloud run service also needs to call other cloud run service besides external service, so second option is fit for me.

However, I’m wondering if there is a way to register all my cloud run services in the VPC with a private IP, in this way I can Configure Egress of cloud run services to route only private IPs through the VPC connector. Is it possible such configuration?

Thanks in advance!

4

Hello,

I have the same problem when implementing this solution, is there any update?

when route all traffic to the VPC, cloud run does have internet access even though cloud nat is already configured?

Use Cloud NAT, following the documentation you found. Once your request is in the VPC Network, Cloud NAT is the way to get it routed out of the network, even if you don’t need a static outbound IP.