La salida directa de VPC es más rápida y puede gestionar más tráfico que los conectores, lo que permite ofrecer una latencia más baja y un mayor rendimiento, ya que utiliza una ruta de red directa nueva en lugar de instancias de conector.
Migrar servicios a la salida de VPC directa gradualmente
Cuando migres servicios de Cloud Run de conectores de acceso a VPC sin servidor a salida de VPC directa, te recomendamos que lo hagas de forma gradual.
Para hacer la transición gradualmente, sigue estos pasos:
Sigue las instrucciones de esta sección para actualizar tu servicio y usar la salida de VPC directa.
Haga clic en el servicio que quiera migrar de un conector a la salida de VPC directa y, a continuación, en Editar y desplegar nueva revisión.
Haz clic en la pestaña Redes.
En Conectarse a una VPC para el tráfico saliente, haga clic en Enviar tráfico directamente a una VPC.
En el campo Red, selecciona la red de VPC a la que quieras enviar tráfico.
En el campo Subred, selecciona la subred de la que tu servicio recibe direcciones IP. Puedes desplegar varios servicios en la misma subred.
Opcional: Introduce los nombres de las etiquetas de red
que quieras asociar a tu servicio o servicios. Las etiquetas de red se especifican a nivel de revisión. Cada revisión de servicio puede tener etiquetas de red diferentes, como network-tag-2.
En Enrutamiento del tráfico, seleccione una de las siguientes opciones:
Dirige solo las solicitudes a IP privadas a la VPC para enviar solo tráfico a direcciones internas a través de la red VPC.
Dirige todo el tráfico a la VPC para enviar todo el tráfico de salida a través de la red de VPC.
Haz clic en Desplegar.
Para verificar que tu servicio está en tu red VPC, haz clic en el servicio y, a continuación, en la pestaña Redes. La red y la subred se muestran en la tarjeta VPC.
Ahora puedes enviar solicitudes directamente desde tu servicio de Cloud Run a cualquier recurso de la red VPC, según lo permitan tus reglas de firewall.
gcloud
Para migrar un servicio de Cloud Run de un conector a una salida de VPC directa mediante la CLI de Google Cloud, sigue estos pasos:
Actualiza tu servicio de Cloud Run con el siguiente comando:
SUBNET con el nombre de tu subred. Puedes desplegar o ejecutar varios servicios o trabajos en la misma subred.
Opcional: NETWORK_TAG_NAMES con los nombres separados por comas
de las etiquetas de red
que quieras asociar a un servicio. En el caso de los servicios, las etiquetas de red se especifican a nivel de revisión. Cada revisión de servicio puede tener etiquetas de red diferentes, como network-tag-2.
Haga clic en la tarea que quiera migrar de un conector a la salida de VPC directa y, a continuación, haga clic en Editar.
Haz clic en la pestaña Redes.
Haz clic en Contenedor, Variables y secretos, Conexiones y Seguridad para desplegar la página de propiedades del trabajo.
Haz clic en la pestaña Conexiones.
En Conectarse a una VPC para el tráfico saliente, haga clic en Enviar tráfico directamente a una VPC.
En el campo Red, selecciona la red de VPC a la que quieras enviar tráfico.
En el campo Subred, selecciona la subred de la que tu tarea recibe direcciones IP. Puedes implementar varios trabajos en la misma subred.
Opcional: Introduce los nombres de las etiquetas de red
que quieras asociar a tu servicio o servicios. Las etiquetas de red se especifican a nivel de revisión. Cada revisión de servicio puede tener etiquetas de red diferentes, como network-tag-2.
En Enrutamiento del tráfico, seleccione una de las siguientes opciones:
Dirige solo las solicitudes a IP privadas a la VPC para enviar solo tráfico a direcciones internas a través de la red VPC.
Dirige todo el tráfico a la VPC para enviar todo el tráfico de salida a través de la red de VPC.
Haz clic en Actualizar.
Para verificar que tu trabajo está en tu red de VPC, haz clic en el trabajo y, a continuación, en la pestaña Configuración. La red y la subred se muestran en la tarjeta VPC.
Ahora puedes ejecutar tu trabajo de Cloud Run y enviar solicitudes desde el trabajo a cualquier recurso de la red de VPC, según lo permitan tus reglas de cortafuegos.
gcloud
Para migrar un trabajo de Cloud Run de un conector a una salida de VPC directa mediante la CLI de Google Cloud, sigue estos pasos:
Actualiza tu trabajo de Cloud Run con el siguiente comando:
SUBNET con el nombre de tu subred. Puedes desplegar o ejecutar varios servicios o trabajos en la misma subred.
Opcional: NETWORK_TAG_NAMES con los nombres de las etiquetas de red que quieras asociar a un trabajo. En el caso de los trabajos, las etiquetas de red se especifican a nivel de ejecución. Cada ejecución de un trabajo puede tener etiquetas de red diferentes, como network-tag-2.
[[["Es fácil de entender","easyToUnderstand","thumb-up"],["Me ofreció una solución al problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Es difícil de entender","hardToUnderstand","thumb-down"],["La información o el código de muestra no son correctos","incorrectInformationOrSampleCode","thumb-down"],["Me faltan las muestras o la información que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-08-21 (UTC)."],[],[],null,["# Migrate standard VPC connector to Direct VPC egress\n\nThis page is for networking specialists who want to migrate standard VPC\nnetwork traffic from using [Serverless VPC Access connectors](/run/docs/configuring/vpc-connectors)\nto using [Direct VPC egress](/run/docs/configuring/vpc-direct-vpc)\nwhen sending traffic to a VPC network.\n\nDirect VPC egress is faster and can handle more traffic than connectors,\ndelivering lower latency and higher throughput because it uses a new, direct\nnetwork path rather than connector instances.\n\nBefore migration, we recommend that you familiarize yourself with Direct VPC\negress [prerequisites](/run/docs/configuring/vpc-direct-vpc#before_you_begin),\n[limitations](/run/docs/configuring/vpc-direct-vpc#limitations),\n[IP address allocation](/run/docs/configuring/vpc-direct-vpc#direct-vpc-ip-allocation),\nand [IAM permissions](/run/docs/configuring/vpc-direct-vpc#set_up_iam_permissions).\n\nMigrate services to Direct VPC egress\n-------------------------------------\n\n| **Important:** Connectors continue to incur charges even if they have no traffic and are disconnected. For details, see [pricing](/vpc/pricing#serverless-vpc-pricing). If you no longer need your connector, be sure to [delete](/run/docs/configuring/vpc-connectors#delete) it to avoid continued billing.\n\nMigrate services to Direct VPC egress gradually\n-----------------------------------------------\n\nWhen you migrate Cloud Run services from Serverless VPC Access\nconnectors to Direct VPC egress, we recommend that you do so in a gradual\ntransition.\n\nTo transition gradually:\n\n1. Follow the instructions in this section to update your service to use Direct VPC egress.\n2. [Split a small percentage of traffic](/run/docs/rollouts-rollbacks-traffic-migration#split-traffic) to determine whether the traffic works correctly.\n3. Update the traffic split to send all traffic to the new revision using Direct VPC egress.\n\nTo migrate traffic with Direct VPC egress for a service, use the\nGoogle Cloud console or Google Cloud CLI: \n\n### Console\n\n1. In the Google Cloud console, go to the **Cloud Run** page.\n\n [Go to Cloud Run](https://console.cloud.google.com/run)\n2. Click the service that you want to migrate from a connector to Direct\n VPC egress, then click **Edit and deploy new revision**.\n\n3. Click the **Networking** tab.\n\n4. From **Connect to a VPC for outbound traffic** , click **Send traffic directly to a VPC**.\n\n5. In the **Network** field, select the VPC\n network that you want to send traffic to.\n\n6. In the **Subnet** field, select the subnet where your service receives IP\n addresses from. You can deploy multiple services on the same subnet.\n\n7. Optional: Enter the names of the [network tags](/vpc/docs/add-remove-network-tags#restrictions)\n that you want to associate with your service or services. Network tags are\n specified at the revision-level. Each service revision can have different\n network tags, such as `network-tag-2`.\n\n8. For **Traffic routing**, select one of the following:\n\n - **Route only requests to private IPs to the VPC** to send only traffic to internal addresses through the VPC network.\n - **Route all traffic to the VPC** to send all outbound traffic through the VPC network.\n9. Click **Deploy**.\n\n10. To verify that your service is on your VPC network, click\n the service, then click the **Networking** tab. The network and subnet\n are listed in the **VPC** card.\n\n You can now send requests directly from your Cloud Run service to\n any resource on the VPC network, as allowed by your\n firewall rules.\n\n### gcloud\n\n\nTo migrate a Cloud Run service from a connector to Direct VPC\negress using the Google Cloud CLI:\n\n1. Update your Cloud Run service with the following command:\n\n ```bash\n gcloud run services update SERVICE_NAME \\\n --clear-vpc-connector \\\n --network=NETWORK \\\n --subnet=SUBNET \\\n --network-tags=NETWORK_TAG_NAMES \\\n --vpc-egress=EGRESS_SETTING \\\n --region=REGION\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the name of your service.\n - \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e with the name of your VPC network.\n - \u003cvar translate=\"no\"\u003eSUBNET\u003c/var\u003e with the name of your subnet. You can deploy or execute multiple services or jobs on the same subnet.\n - Optional: \u003cvar translate=\"no\"\u003eNETWORK_TAG_NAMES\u003c/var\u003e with the comma-separated names of the [network tags](/vpc/docs/add-remove-network-tags#restrictions) you want to associate with a service. For services, network tags are specified at the revision-level. Each service revision can have different network tags, such as `network-tag-2`.\n - \u003cvar translate=\"no\"\u003eEGRESS_SETTING\u003c/var\u003e with an [egress setting value](/sdk/gcloud/reference/run/deploy#--vpc-egress):\n - `all-traffic`: Sends all outbound traffic through the VPC network.\n - `private-ranges-only`: Sends only traffic to internal addresses through the VPC network.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with a region for your service.\n2. To verify that your service is on your VPC network, run\n the following command:\n\n ```bash\n gcloud run services describe SERVICE_NAME \\\n --region=REGION\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the name of your service.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region for your service that you specified in the previous step.\n\n The output should contain the name of your network, subnet, and egress\n setting, for example: \n\n VPC access:\n Network: default\n Subnet: subnet\n Egress: private-ranges-only\n\nYou can now send requests from your Cloud Run service to any\nresource on the VPC network, as allowed by your firewall\nrules.\n\nMigrate jobs to Direct VPC egress\n---------------------------------\n\n| **Important:** Connectors continue to incur charges even if they have no traffic and are disconnected. For details, see [pricing](/vpc/pricing#serverless-vpc-pricing). If you no longer need your connector, be sure to [delete](/run/docs/configuring/vpc-connectors#delete) it to avoid continued billing.\n\nYou can migrate traffic with Direct VPC egress for a job by using the\nGoogle Cloud console or Google Cloud CLI. \n\n### Console\n\n1. In the Google Cloud console, go to the **Cloud Run** page.\n\n [Go to Cloud Run](https://console.cloud.google.com/run)\n2. Click the job that you want to migrate from a connector to Direct\n VPC egress, then click **Edit**.\n\n3. Click the **Networking** tab.\n\n4. Click **Container, Variables \\& Secrets, Connections, Security** to\n expand the job properties page.\n\n5. Click the **Connections** tab.\n\n6. From **Connect to a VPC for outbound traffic** , click **Send traffic directly to a VPC**.\n\n7. In the **Network** field, select the VPC\n network that you want to send traffic to.\n\n8. In the **Subnet** field, select the subnet where your job receives IP\n addresses from. You can deploy multiple jobs on the same subnet.\n\n9. Optional: Enter the names of the [network tags](/vpc/docs/add-remove-network-tags#restrictions)\n that you want to associate with your service or services. Network tags are\n specified at the revision-level. Each service revision can have different\n network tags, such as `network-tag-2`.\n\n10. For **Traffic routing**, select one of the following:\n\n - **Route only requests to private IPs to the VPC** to send only traffic to internal addresses through the VPC network.\n - **Route all traffic to the VPC** to send all outbound traffic through the VPC network.\n11. Click **Update**.\n\n12. To verify that your job is on your VPC network, click\n the job, then click the **Configuration** tab. The network and subnet are\n listed in the **VPC** card.\n\nYou can now execute your Cloud Run job and send requests from the\njob to any resource on the VPC network, as allowed by your\nfirewall rules.\n\n### gcloud\n\n\nTo migrate a Cloud Run job from a connector to Direct VPC\negress using the Google Cloud CLI:\n\n1. Update your Cloud Run job with the following command:\n\n ```bash\n gcloud run jobs update JOB_NAME \\\n --clear-network \\\n --image=IMAGE_URL \\\n --network=NETWORK \\\n --subnet=SUBNET \\\n --network-tags=NETWORK_TAG_NAMES \\\n --vpc-egress=EGRESS_SETTING \\\n --region=REGION\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eJOB_NAME\u003c/var\u003e with the name of your job.\n - \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e with the name of your VPC network.\n - \u003cvar translate=\"no\"\u003eSUBNET\u003c/var\u003e with the name of your subnet. You can deploy or execute multiple services or jobs on the same subnet.\n - Optional: \u003cvar translate=\"no\"\u003eNETWORK_TAG_NAMES\u003c/var\u003e with the names of the [network tags](/vpc/docs/add-remove-network-tags#restrictions) you want to associate with a job. For jobs, network tags are specified at the execution-level. Each job execution can have different network tags, such as `network-tag-2`.\n - \u003cvar translate=\"no\"\u003eEGRESS_SETTING\u003c/var\u003e with an [egress setting value](/sdk/gcloud/reference/run/deploy#--vpc-egress):\n - `all-traffic`: Sends all outbound traffic through the VPC network.\n - `private-ranges-only`: Sends only traffic to internal addresses through the VPC network.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with a region for your job.\n2. To verify that your job is on your VPC network, run\n the following command:\n\n ```bash\n gcloud run jobs describe JOB_NAME \\\n --region=REGION\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eJOB_NAME\u003c/var\u003e with the name of your job.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region for your job that you specified in the previous step.\n\n The output should contain the name of your network, subnet, and egress\n setting, for example: \n\n VPC access:\n Network: default\n Subnet: subnet\n Egress: private-ranges-only\n\nYou can now send requests from your Cloud Run job to any\nresource on the VPC network, as allowed by your firewall\nrules."]]
