Console

1. Go to the Serverless VPC Access overview page.

   Go to Serverless VPC Access

2. ClickCreate connector.

3. In theName field, enter a name for your connector, matchingCompute Enginenamingconventions, withthe additional requirements that the name must be less than 21characters long, and that hyphens (-) count as two characters.

4. In theRegion field, select a region for your connector.This must match the region of your serverless service.

   If your service or job is in the regionus-central oreurope-west,useus-central1 oreurope-west1.

5. In theNetwork field, select the VPC networkto attach your connector to.

6. In theSubnet field, select one of the following options:

   • Create a connector using an existing subnet: Select the existingsubnet in theSubnet field.

   • Create a connector and a new subnet: SelectCustom IP range intheSubnet field. Then, enter the first address in an unused/28CIDR (for example10.8.0.0/28) to use as the primary IPv4 addressrange of a new subnet that Google Cloud creates in the connector'sVPC network. Ensure that the IP range does not conflictwith any existing routes in the connector's VPC network.The name of the new subnet begins with the "aet-" prefix.

7. (Optional) To set scaling options for additional control overthe connector, clickShow Scaling Settings to display the scalingform.

   1. Set the minimum and maximum number of instances for your connector,or use the defaults, which are 2 (min) and 10 (max). Theconnector scales up to the maximum specified if traffic usage requiresit, butthe connector does not scale back down when trafficdecreases. You must use values between2 and10.
   2. In theInstance Type menu, choose the machine type to beused for the connector, or use the defaulte2-micro. Notice the costsidebar on the right when you choose the instance type, which displaysbandwidth and cost estimations.

8. ClickCreate.

9. A green check mark will appear next to the connector's name when it isready to use.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. Updategcloud components to the latest version:

   gcloudcomponentsupdate

3. Ensure that the Serverless VPC Access API is enabled foryour project:

   gcloudservicesenablevpcaccess.googleapis.com

4. Create the connector using one of the following options:

   For more details and optional arguments, see thegcloudreference.

   • Create a connector using an existing subnet:

     gcloudcomputenetworksvpc-accessconnectorscreateCONNECTOR_NAME\--regionREGION\--subnetSUBNET_NAME\--subnet-projectHOST_PROJECT_ID\--min-instancesMIN\--max-instancesMAX\--machine-typeMACHINE_TYPE

     Replace the following:

     • CONNECTOR_NAME: a name for your connector,matching Compute Enginenamingconventions,with the additional requirements that the name must be less than 21characters long, and that hyphens (-) count as two characters.
     • REGION: a region for your connector, matching theregion of your serverless service or job. If your service or job isinus-central oreurope-west, useus-central1 oreurope-west1.
     • SUBNET_NAME: the name of the existing subnet.
     • HOST_PROJECT_ID: the Shared VPC hostproject ID. If the connector and existing subnet are located thesame project, omit the--subnet-project flag.
     • MIN: the minimum number of instances to use forthe connector. Use an integer between2(the default) and9.
     • MAX: the maximum number of instances to use forthe connector. Use an integer between3 and10 (the default).If the connector scales up to the maximum number of instances,itdoes not scale back down.
     • MACHINE_TYPE: must be one of the following:f1-micro,e2-micro, ore2-standard-4.

   • Create a connector and a new subnet:

     gcloudcomputenetworksvpc-accessconnectorscreateCONNECTOR_NAME\--regionREGION\--networkVPC_NETWORK\--rangeIP_RANGE--min-instancesMIN\--max-instancesMAX\--machine-typeMACHINE_TYPE

     Replace the following:

     • CONNECTOR_NAME: a name for your connector,matching Compute Enginenamingconventions,with the additional requirements that the name must be less than 21characters long, and that hyphens (-) count as two characters.
     • REGION: a region for your connector, matching theregion of your serverless service or job. If your service or job isinus-central oreurope-west, useus-central1 oreurope-west1.
     • VPC_NETWORK: the name of the VPCnetwork to attach your connector to. The connector andVPC network must be located in the same project.
     • IP_RANGE: provide an unused/28 CIDR (forexample10.8.0.0/28) to use as the primary IPv4 address rangeof a new subnet that Google Cloud creates in the connector'sVPC network. Ensure that the IP range does notconflict with any existing routes in the connector'sVPC network. The name of the new subnet begins withthe "aet-" prefix.
     • MIN: the minimum number of instances to use forthe connector. Use an integer between2(the default) and9.
     • MAX: the maximum number of instances to use forthe connector. Use an integer between3 and10 (the default).If the connector scales up to the maximum number of instances,itdoes not scale back down.
     • MACHINE_TYPE: must be one of the following:f1-micro,e2-micro, ore2-standard-4.

5. Verify that your connector is in theREADY state before using it:

   gcloudcomputenetworksvpc-accessconnectorsdescribeCONNECTOR_NAME\--regionREGION

   Replace the following:

   • CONNECTOR_NAME: the name of your connector; this isthe name that you specified in the previous step.
   • REGION: the region of your connector; this is theregion that you specified in the previous step.

   The output should contain the linestate: READY.

Terraform

You can use aTerraform resource to enable thevpcaccess.googleapis.com API.

resource "google_project_service" "vpcaccess-api" {  project = var.project_id # Replace this with your project ID in quotes  service = "vpcaccess.googleapis.com"}

You can useTerraform modules to create a VPC network and subnet and then create theconnector.

module "test-vpc-module" {  source       = "terraform-google-modules/network/google"  version      = "~> 13.0"  project_id   = var.project_id # Replace this with your project ID in quotes  network_name = "my-serverless-network"  mtu          = 1460  subnets = [    {      subnet_name   = "serverless-subnet"      subnet_ip     = "10.10.10.0/28"      subnet_region = "us-central1"    }  ]}module "serverless-connector" {  source     = "terraform-google-modules/network/google//modules/vpc-serverless-connector-beta"  version    = "~> 13.0"  project_id = var.project_id  vpc_connectors = [{    name        = "central-serverless"    region      = "us-central1"    subnet_name = module.test-vpc-module.subnets["us-central1/serverless-subnet"].name    # host_project_id = var.host_project_id # Specify a host_project_id for shared VPC    machine_type  = "e2-standard-4"    min_instances = 2    max_instances = 7    }    # Uncomment to specify an ip_cidr_range    #   , {    #     name          = "central-serverless2"    #     region        = "us-central1"    #     network       = module.test-vpc-module.network_name    #     ip_cidr_range = "10.10.11.0/28"    #     subnet_name   = null    #     machine_type  = "e2-standard-4"    #     min_instances = 2    #   max_instances = 7 }  ]  depends_on = [    google_project_service.vpcaccess-api  ]}

Console

1. In the Google Cloud console, go to Cloud Run:

   Go to Cloud Run

2. SelectServices from the Cloud Run navigation menu, and clickDeploy container to configure a new service.If you are configuring an existing service, click theservice, then clickEdit and deploy new revision.

3. If you are configuring a new service, fill out the initial servicesettings page, then clickContainer(s), Volumes, Networking, Security to expand theservice configuration page.

4. Click theNetworking tab.

   

   • In theNetwork field, choose one of thefollowing options from the menu:
     • To disconnect your service from a VPCnetwork, selectNone.
     • To use an existing connector, select it from the drop-down list or selectCustom to use an existing connector that's not shown in the drop-downlist.
     • To create a new connector, selectAdd new VPC connector.SeeCreate a Serverless VPC Access connectorfor details on creating a connector.
     • ForTraffic routing, select one of the following:
       • Route only requests to private IPs to the VPC to send onlytraffic to internal addresses through the VPC network.
       • Route all traffic to the VPC to send all outbound trafficthrough the VPC network.

5. ClickCreate orDeploy.

gcloud

To specify a connector duringdeployment, use the--vpc-connectorflag:

gcloudrundeploySERVICE--imageIMAGE_URL--vpc-connectorCONNECTOR_NAME

Replace the following:

• SERVICE: the name of your service.
• IMAGE_URL: a reference to the container image, forexample,us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry,therepositoryREPO_NAME mustalready be created. The URL follows the format ofLOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG.
• CONNECTOR_NAME: the name of yourconnector.

To attach, update, or remove a connector for an existing service, use thegcloud run services updatecommand with either of the following flags as needed:

• --vpc-connector
• --clear-vpc-connector

For example, to attach or update a connector:

gcloudrunservicesupdateSERVICE--vpc-connectorCONNECTOR_NAME

Replace the following:

• SERVICE: the name of your service.
• CONNECTOR_NAME: the name of yourconnector.

YAML

1. If you are creating a new service, skip this step.If you are updating an existing service, download itsYAML configuration:

   gcloudrunservicesdescribeSERVICE--formatexport>service.yaml

2. Add or update therun.googleapis.com/vpc-access-connector attribute undertheannotations attribute under the top-levelspec attribute:

   apiVersion:serving.knative.dev/v1kind:Servicemetadata:name:SERVICEspec:template:metadata:annotations:run.googleapis.com/vpc-access-connector:CONNECTOR_NAMEname:REVISION

   Replace the following:

   • SERVICE: the name of yourCloud Run service.
   • CONNECTOR_NAME: the name of yourconnector.
   • REVISION with a new revision name or delete it (if present). If you supply a new revision name, itmust meet the following criteria:
     • Starts withSERVICE-
     • Contains only lowercase letters, numbers and-
     • Does not end with a-
     • Does not exceed 63 characters

3. Create or update the service using the following command:

   gcloudrunservicesreplaceservice.yaml

Terraform

You can use aTerraform resource to create a service and configure it to use your connector.

# Cloud Run serviceresource "google_cloud_run_v2_service" "gcr_service" {  name     = "mygcrservice"  location = "us-west1"  deletion_protection = false # set to "true" in production  template {    containers {      image = "us-docker.pkg.dev/cloudrun/container/hello"      resources {        limits = {          cpu    = "1000m"          memory = "512Mi"        }      }      # the service uses this SA to call other Google Cloud APIs      # service_account_name = myservice_runtime_sa    }    scaling {      # Limit scale up to prevent any cost blow outs!      max_instance_count = 5    }    vpc_access {      # Use the VPC Connector      connector = google_vpc_access_connector.connector.id      # all egress from the service should go through the VPC Connector      egress = "ALL_TRAFFIC"    }  }}

Console

1. In the Google Cloud console, go to the Cloud RunJobs page:

   Go to Cloud Run

2. ClickDeploy container to fill outthe initial job settings page. If you are configuring an existing job,select the job, then clickView and edit job configuration.

3. ClickContainer(s), Volumes, Connections, Security to expand the job properties page.

4. Click theConnections tab.

   

   • In theNetwork field, choose one of thefollowing options from the menu:
     • To disconnect your job from a VPCnetwork, selectNone.
     • To use an existing connector, select it from the drop-down list or selectCustom to use an existing connector that's not shown in the drop-downlist.
     • To create a new connector, selectAdd new VPC connector.
       SeeCreate a Serverless VPC Access connectorfor details on creating a connector.

5. ClickCreate orUpdate.

gcloud

To specify a connector during the job deployment, use the--vpc-connectorflag:

gcloudrunjobscreateJOB--imageIMAGE_URL--vpc-connectorCONNECTOR_NAME

Replace the following:

• JOB: the name of your job.
• IMAGE_URL: a reference to the container image, forexample,us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry,therepositoryREPO_NAME mustalready be created. The URL follows the format ofLOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG.
• CONNECTOR_NAME: the name of yourconnector.

To attach, update, or remove a connector for an existing service, use thegcloud run jobs updatecommand with either of the following flags as needed:

• --vpc-connector
• --clear-vpc-connector

For example, to attach or update a connector:

gcloudrunjobsupdateJOB--vpc-connectorCONNECTOR_NAME

Replace the following:

• JOB: the name of your job.
• CONNECTOR_NAME: the name of yourconnector.

YAML

You can download and view an existing job configuration by using thegcloud run jobs describe --format export command, which yields cleanedresults in YAML format. You can then modify the fields described below andupload the modified YAML by using thegcloud run jobs replace command.Make sure you only modify fields as documented.

1. To view and download the configuration:

   gcloudrunjobsdescribeJOB--formatexport>job.yaml

2. Add or update therun.googleapis.com/vpc-access-connector attribute undertheannotations attribute under the top-levelspec attribute:

   apiVersion:serving.knative.dev/v1kind:Jobmetadata:name:JOBspec:template:metadata:annotations:run.googleapis.com/vpc-access-connector:CONNECTOR_NAME

   Replace the following:

   • JOB: the name of your Cloud Run job.
   • CONNECTOR_NAME: the name of your connector.Therun.googleapis.com/vpc-access-connector attribute isrequired when specifying an egress setting.

3. Replace the job with its new configuration by using the following command:

   gcloudrunjobsreplacejob.yaml

Network tags

The following steps show how to create ingress rules that restrict aconnector's access to your VPC network based on the connectornetwork tags.

1. Ensure that you have the required permissions to insert firewall rules.You must have one of the followingIdentity and Access Management (IAM) roles:

   • Compute Security Admin role
   • Custom IAM role with thecompute.firewalls.createpermission enabled

2. Deny connector traffic across your VPC network.

   Create an ingress firewall rule with priority lower than 1000 on yourVPC network to deny ingress from the connector networktag. This overrides the implicit firewall rule thatServerless VPC Access creates on your VPCnetwork by default.

   gcloudcomputefirewall-rulescreateRULE_NAME\--action=DENY\--rules=PROTOCOL\--source-tags=VPC_CONNECTOR_NETWORK_TAG\--direction=INGRESS\--network=VPC_NETWORK\--priority=PRIORITY

   Replace the following:

   • RULE_NAME: the name of your new firewall rule. For example,deny-vpc-connector.

   • PROTOCOL: one or more protocols that you want to allow from yourVPC connector. Supported protocols aretcp orudp. For example,tcp:80,udpallows TCP traffic through port 80 and UDP traffic. For more information, seethe documentation for theallowflag.

     For security and validation purposes, you can alsoconfigure deny rules to block traffic for the following unsupportedprotocols:ah,all,esp,icmp,ipip, andsctp.

   • VPC_CONNECTOR_NETWORK_TAG: the universal connector networktag if you want to restrict access for all connectors (including anyconnectors made in the future), or the unique network tag if you want torestrict access for a specific connector.

     • Universal network tag:vpc-connector

     • Unique network tag:vpc-connector-REGION-CONNECTOR_NAME

       Replace:

       • REGION: the region of the connector that you wantto restrict
       • CONNECTOR_NAME: the name of the connector that youwant to restrict

     To learn more about connector network tags, seeNetwork tags.

   • VPC_NETWORK: the name of your VPC network

   • PRIORITY: an integer between 0-65535. For example, 0 sets thehighest priority.

3. Allow connector traffic to the resource that should receive connectortraffic.

   Use theallow andtarget-tags flags to create an ingress firewallrule targeting the resource in your VPC network that youwant the VPC connector to access. Set the priority forthis rule to be a lower value than the priority of the rule you made inthe previous step.

   gcloudcomputefirewall-rulescreateRULE_NAME\--allow=PROTOCOL\--source-tags=VPC_CONNECTOR_NETWORK_TAG\--direction=INGRESS\--network=VPC_NETWORK\--target-tags=RESOURCE_TAG\--priority=PRIORITY

   Replace the following:

   • RULE_NAME: the name of your new firewall rule. For example,allow-vpc-connector-for-select-resources.

   • PROTOCOL: one or more protocols that you want to allow from yourVPC connector. Supported protocols aretcp orudp. For example,tcp:80,udpallows TCP traffic through port 80 and UDP traffic. For more information, seethe documentation for theallowflag.

   • VPC_CONNECTOR_NETWORK_TAG: the universal connector networktag if you want to restrict access for all connectors (including anyconnectors made in the future), or the unique network tag if you want torestrict access for a specific connector. This must match the networktag that you specified in the previous step.

     • Universal network tag:vpc-connector

     • Unique network tag:vpc-connector-REGION-CONNECTOR_NAME

       Replace:

       • REGION: the region of the connector that you wantto restrict
       • CONNECTOR_NAME: the name of the connector that youwant to restrict

     To learn more about connector network tags, seeNetwork tags.

   • VPC_NETWORK: the name of your VPC network

   • RESOURCE_TAG: the network tag for the VPCresource that you want your VPC connector to access

   • PRIORITY: an integer less than the priority you set inthe previous step. For example, if you set the priority for the ruleyou created in the previous step to 990, try 980.

For more information about the required and optional flags for creatingfirewall rules, refer to thedocumentation forgcloud compute firewall-rules create.

CIDR range

The following steps show how to create ingress rules that restrict aconnector's access to your VPC network based on the connector'sCIDR range.

1. Ensure that you have the required permissions to insert firewall rules.You must have one of the followingIdentity and Access Management (IAM) roles:

   • Compute Security Admin role
   • Custom IAM role with thecompute.firewalls.createpermission enabled

2. Deny connector traffic across your VPC network.

   Create an ingress firewall rule with priority lower than 1000 on yourVPC network to deny ingress from the connector's CIDRrange. This overrides the implicit firewall rule thatServerless VPC Access creates on your VPCnetwork by default.

   gcloudcomputefirewall-rulescreateRULE_NAME\--action=DENY\--rules=PROTOCOL\--source-ranges=VPC_CONNECTOR_CIDR_RANGE\--direction=INGRESS\--network=VPC_NETWORK\--priority=PRIORITY

   Replace the following:

   • RULE_NAME: the name of your new firewall rule. For example,deny-vpc-connector.

   • PROTOCOL: one or more protocols that you want to allow from yourVPC connector. Supported protocols aretcp orudp. For example,tcp:80,udpallows TCP traffic through port 80 and UDP traffic. For more information, seethe documentation for theallowflag.

     For security and validation purposes, you can alsoconfigure deny rules to block traffic for the following unsupportedprotocols:ah,all,esp,icmp,ipip, andsctp.

   • VPC_CONNECTOR_CIDR_RANGE: the CIDR range for the connectorwhose access you are restricting

   • VPC_NETWORK: the name of your VPC network

   • PRIORITY: an integer between 0-65535. For example, 0 sets thehighest priority.

3. Allow connector traffic to the resource that should receive connectortraffic.

   Use theallow andtarget-tags flags to create an ingress firewallrule targeting the resource in your VPC network that youwant the VPC connector to access. Set the priority forthis rule to be a lower value than the priority of the rule you made inthe previous step.

   gcloudcomputefirewall-rulescreateRULE_NAME\--allow=PROTOCOL\--source-ranges=VPC_CONNECTOR_CIDR_RANGE\--direction=INGRESS\--network=VPC_NETWORK\--target-tags=RESOURCE_TAG\--priority=PRIORITY

   Replace the following:

   • RULE_NAME: the name of your new firewall rule. For example,allow-vpc-connector-for-select-resources.

   • PROTOCOL: one or more protocols that you want to allow from yourVPC connector. Supported protocols aretcp orudp. For example,tcp:80,udpallows TCP traffic through port 80 and UDP traffic. For more information, seethe documentation for theallowflag.

   • VPC_CONNECTOR_CIDR_RANGE: the CIDR range for the connectoryou whose access you are restricting

   • VPC_NETWORK: the name of your VPC network

   • RESOURCE_TAG: the network tag for the VPCresource that you want your VPC connector to access

   • PRIORITY: an integer less than the priority you set inthe previous step. For example, if you set the priority for the ruleyou created in the previous step to 990, try 980.

For more information about the required and optional flags for creatingfirewall rules, see thedocumentation forgcloud compute firewall-rules create.

Console

1. In the Google Cloud console, go to Cloud Run:

   Go to Cloud Run

2. SelectServices from the Cloud Run navigation menu, and clickDeploy container to configure a new service.If you are configuring an existing service, click theservice, then clickEdit and deploy new revision.

3. If you are configuring a new service, fill out the initial servicesettings page, then clickContainer(s), Volumes, Networking, Security to expand theservice configuration page.

4. Click theNetworking tab.

   

   • After you select a VPC connector,selectRoute only requests to private IPs to the VPC orRoute all traffic to the VPC.

5. ClickCreate orDeploy.

gcloud

To specify an egress setting, use the--vpc-egress flag. You can specifyan egress setting duringdeployment:

gcloudrundeploySERVICE\--imageIMAGE_URL\--vpc-connectorCONNECTOR_NAME\--vpc-egressEGRESS_SETTING

Replace the following:

• SERVICE: the name of your service.
• IMAGE_URL: a reference to the container image, forexample,us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry,therepositoryREPO_NAME mustalready be created. The URL follows the format ofLOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG.
• CONNECTOR_NAME: the name of yourconnector.
• EGRESS_SETTING: anegress setting value:
  • all-traffic: Sends all outbound traffic through the connector.
  • private-ranges-only: Sends only traffic to internal addressesthrough the VPC connector.

You can alsoupdate an existingservice and change the egress setting:

gcloudrunservicesupdateSERVICE--vpc-egressEGRESS_SETTING

Replace the following:

• SERVICE: the name of your service.
• EGRESS_SETTING: anegress setting valueas listed above.

YAML

1. If you are creating a new service, skip this step.If you are updating an existing service, download itsYAML configuration:

   gcloudrunservicesdescribeSERVICE--formatexport>service.yaml

2. Add or update therun.googleapis.com/vpc-access-egress attribute undertheannotations attribute under the top-levelspec attribute:

   apiVersion:serving.knative.dev/v1kind:Servicemetadata:name:SERVICEspec:template:metadata:annotations:run.googleapis.com/vpc-access-connector:CONNECTOR_NAMErun.googleapis.com/vpc-access-egress:EGRESS_SETTINGname:REVISION

   Replace the following:

   • SERVICE: the name of your Cloud Run service.
   • CONNECTOR_NAME: the name of your connector.Therun.googleapis.com/vpc-access-connector attribute isrequired when specifying an egress setting.
   • EGRESS_SETTING: one of the following:
     • all-traffic: Sends all outbound traffic through the connector.
     • private-ranges-only: Sends only traffic to internal addressesthrough the VPC connector.
     • REVISION with a new revision name or delete it (if present). If you supply a new revision name, itmust meet the following criteria:
       • Starts withSERVICE-
       • Contains only lowercase letters, numbers and-
       • Does not end with a-
       • Does not exceed 63 characters

3. Create or update the service using the following command:

   gcloudrunservicesreplaceservice.yaml

Console

1. In the Google Cloud console, go to the Cloud RunJobs page:

   Go to Cloud Run

2. ClickDeploy container to fill outthe initial job settings page. If you are configuring an existing job,select the job, then clickView and edit job configuration.

3. ClickContainer(s), Volumes, Connections, Security to expand the job properties page.

4. Click theConnections tab.

   

   • After you select a connector, selectRoute only requests to private IPs to the VPC orRoute all traffic to the VPC.

5. ClickCreate orUpdate.

gcloud

To specify an egress setting, use the--vpc-egress flag. You can specifyan egress setting during the job deployment process:

gcloudrunjobscreateJOB\--imageIMAGE_URL\--vpc-connectorCONNECTOR_NAME\--vpc-egressEGRESS_SETTING

Replace the following:

• JOB: the name of your job.
• IMAGE_URL: a reference to the container image, forexample,us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry,therepositoryREPO_NAME mustalready be created. The URL follows the format ofLOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG.
• CONNECTOR_NAME: the name of yourconnector.
• EGRESS_SETTING: anegress setting value:
  • all-traffic: Sends all outbound traffic through the connector.
  • private-ranges-only: Sends only traffic to internal addressesthrough the VPC connector.

You can alsoupdate an existingjob and change the egress setting:

gcloudrunjobsupdateJOB--vpc-egressEGRESS_SETTING

Replace the following:

• JOB: the name of your job.
• EGRESS_SETTING: anegress setting valueas listed above.

YAML

You can download and view an existing job configuration by using thegcloud run jobs describe --format export command, which yields cleanedresults in YAML format. You can then modify the fields described below andupload the modified YAML by using thegcloud run jobs replace command.Make sure you only modify fields as documented.

1. Replace the job with its new configuration by using the following command:

   gcloudrunjobsreplacejob.yaml

2. Add or update therun.googleapis.com/vpc-access-egress attribute undertheannotations attribute under the top-levelspec attribute:

   apiVersion:serving.knative.dev/v1kind:Jobmetadata:name:JOBspec:template:metadata:annotations:run.googleapis.com/vpc-access-connector:CONNECTOR_NAMErun.googleapis.com/vpc-access-egress:EGRESS_SETTING

   Replace the following:

   • JOB: the name of your Cloud Run job.
   • CONNECTOR_NAME: the name of your connector. Therun.googleapis.com/vpc-access-connector attribute is required whenspecifying an egress setting.
   • EGRESS_SETTING: one of the following:
     • all-traffic: Sends all outbound traffic through the connector.
     • private-ranges-only: Sends only traffic to internal addressesthrough the VPC connector.

3. Replace the job with its new configuration by using the followingcommand:

   gcloudrunjobsreplacejob.yaml

Console

1. Go to Cloud Run

2. Click the service or job that you are interested in to open the details page.

   • For a service, click theRevisions tab.

   • For a job, click theConfiguration tab.

The Serverless VPC Access connector setting is listed undertheNetworking tab.

gcloud

1. Use the following command to view settings for your service:

   gcloudrunservicesdescribeSERVICE

2. Use the following command to view settings for your job:

   gcloudrunjobsdescribeJOB

3. Locate the Serverless VPC Access connector setting in thereturned configuration.

Console

1. In the Google Cloud console, go to Cloud Run:

   Go to Cloud Run

2. SelectServices from the Cloud Run navigation menu, and clickDeploy container to configure a new service.If you are configuring an existing service, click theservice, then clickEdit and deploy new revision.

3. If you are configuring a new service, fill out the initial servicesettings page, then clickContainer(s), Volumes, Networking, Security to expand theservice configuration page.

4. Click theNetworking tab.

   

   • In theNetworkfield, selectNone to disconnect your service from a VPCnetwork.

5. ClickCreate orDeploy.

gcloud

To disconnect a service, use thegcloud run services updatecommand with the following flag:

• --clear-vpc-connector

gcloudrunservicesupdateSERVICE--clear-vpc-connector

• ReplaceSERVICE with the name of your service.

Console

1. In the Google Cloud console, go to the Cloud RunJobs page:

   Go to Cloud Run

2. ClickDeploy container to fill outthe initial job settings page. If you are configuring an existing job,select the job, then clickView and edit job configuration.

3. ClickContainer(s), Volumes, Connections, Security to expand the job properties page.

4. Click theConnections tab.

   

   • In theNetwork field, selectNoneto disconnect your job from a VPC network.

5. ClickCreate orUpdate.

gcloud

To disconnect a job, use thegcloud run jobs updatecommand with the following flag:

--clear-vpc-connector

gcloudrunjobsupdateJOB--clear-vpc-connector

ReplaceJOB with the name of your job.

1. Go to the Serverless VPC Access overview page.

   Go to Serverless VPC Access

2. Select the connector you want to edit and clickEdit.

3. In theInstance type list, select your preferred machine (instance)type. To learn about available machine types, see the documentation onThroughput and scaling.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To update the connector machine type, run the following command in yourterminal:

   gcloudbetacomputenetworksvpc-accessconnectorsupdateCONNECTOR_NAME--region=REGION--machine-type=MACHINE_TYPE

   Replace the following:
   • CONNECTOR_NAME: the name of your connector
   • REGION: the name of your connector's region
   • MACHINE_TYPE: your preferred machine type. Tolearn about available machine types, see the documentation onThroughput and scaling.

1. Go to the Serverless VPC Access overview page.

   Go to Serverless VPC Access

2. Select the connector you want to edit and clickEdit.

3. In theMinimum instances field, select your preferred minimum number ofinstances.

   The smallest possible value for this field is the current value. Thelargest possible value for this field is the current value in theMaximum instances field minus 1. For example, if the value in theMaximum instances field is 8, then the largest possible value for theMinimum instances field is 7.

4. In theMaximum instances field, select your preferred maximum number ofinstances.

   The smallest possible value for this field is the current value. Thelargest possible value for this field is 10.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. To increase the minimum or maximum number of instances for the connector,run the following command in your terminal:

   gcloudbetacomputenetworksvpc-accessconnectorsupdateCONNECTOR_NAME--region=REGION--min-instances=MIN_INSTANCES--max-instances=MAX_INSTANCES

   Replace the following:

• CONNECTOR_NAME: the name of your connector
• REGION: the name of your connector's region
• MIN_INSTANCES: your preferred minimum number ofinstances.
  • Smallest possible value for this field is the current value ofmin_instances. To find the current value, seeFind the current attribute values.
  • Largest possible value for this field is the currentmax_instancesvalue minus 1, becausemin_instances must be less thanmax_instances.For example, ifmax_instances is 8, the largest possible value for thisfield is 7. If your connector uses the defaultmax-instances value of10, the largest possible value of this field is 9. To find the value ofmax-instances, seeFind the current attribute values.

• MAX_INSTANCES:

  • Smallest possible value for this field is the current value ofmax_instances. To find the current value, seeFind the current attribute values.
  • Largest possible value for this field is 10.

  If you only want to increase the minimum number of instances but not themaximum, you must still specify the maximum number of instances.Conversely, if you only want to update the maximum number of instances butnot the minimum, you must still specify the minimum number of instances.To keep either the minimum or maximum number of instances at their currentvalue, specify their current value. To find their current value, seeFind the current attribute values.

Console

1. Go to the Serverless VPC Access overview page in theGoogle Cloud console:

   Go to Serverless VPC Access

2. Select the connector you want to delete.

3. ClickDelete.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. Use the followinggcloud command to delete a connector:

   gcloud compute networks vpc-access connectors deleteCONNECTOR_NAME --region=REGION

   Replace the following:

   • CONNECTOR_NAME with the name of the connector you want to delete
   • REGION with the region where the connector is located