La salida de VPC directa es más rápida y puede manejar más tráfico que los conectores, lo que entrega una latencia menor y una capacidad de procesamiento mayor, ya que usa una ruta de red nueva y directa en lugar de las instancias de conectores.
Migra servicios a la salida de VPC directa de forma gradual
Cuando migres los servicios de Cloud Run de los conectores del Acceso a VPC sin servidores
a la salida de VPC directa, te recomendamos que lo hagas en una transición
gradual.
Para realizar una transición gradual, haz lo siguiente:
Sigue las instrucciones de esta sección para actualizar tu servicio para usar
la salida de VPC directa.
Haz clic en el servicio que deseas migrar de un conector a la salida
de VPC directa y, luego, en Implementar y editar la nueva revisión.
Haz clic en la pestaña Redes.
En Conéctate a una VPC para el tráfico saliente, haz clic en Enviar tráfico directamente a una VPC.
En el campo Red, selecciona la red de VPC a la que deseas enviar tráfico.
En el campo Subred, selecciona la subred desde la que tu servicio recibe direcciones IP. Puedes implementar varios servicios en la misma subred.
Opcional: Ingresa los nombres de las etiquetas de red que quieres asociar con tu servicio o tus servicios. Las etiquetas de red se especifican a nivel de revisión. Cada revisión del servicio puede tener diferentes etiquetas de red, como network-tag-2.
En Enrutamiento del tráfico, selecciona una de las siguientes opciones:
Enruta solo las solicitudes a IP privadas a la VPC para enviar solo tráfico a direcciones internas a través de la red de VPC.
Enruta todo el tráfico a la VPC para enviar todo el tráfico saliente a través de la red de VPC.
Haz clic en Implementar.
Para verificar que tu servicio esté en tu red de VPC, haz clic en
el servicio y, luego, en la pestaña Herramientas de redes. Las redes y las subredes se detallan en la tarjeta VPC.
Ahora puedes enviar solicitudes directamente desde tu servicio de Cloud Run a
cualquier recurso en la red de VPC, como lo permiten las
reglas de firewall.
gcloud
Para migrar un servicio de Cloud Run de un conector a una salida de VPC
directa a través de Google Cloud CLI, haz lo siguiente:
Actualiza el servicio de Cloud Run con el siguiente comando:
SUBNET por el nombre de la subred Puedes implementar o ejecutar varios servicios o trabajos en la misma subred.
Opcional: NETWORK_TAG_NAMES por los nombres separados por comas de las etiquetas de red que deseas asociar con un servicio. Para los servicios, las etiquetas de red se especifican a nivel de revisión. Cada revisión del servicio puede tener diferentes etiquetas de red, como network-tag-2.
Haz clic en el trabajo que deseas migrar de un conector a la salida de VPC
directa y, luego, en Editar.
Haz clic en la pestaña Redes.
Haz clic en Contenedor, variables y secretos, conexiones y seguridad para expandir la página de propiedades del trabajo.
Haz clic en la pestaña Conexiones.
En Conéctate a una VPC para el tráfico saliente, haz clic en Enviar tráfico directamente a una VPC.
En el campo Red, selecciona la red de VPC a la que deseas enviar tráfico.
En el campo Subred, selecciona la subred desde la que tu trabajo recibe direcciones IP. Puedes implementar varios trabajos en la misma subred.
Opcional: Ingresa los nombres de las etiquetas de red que quieres asociar con tu servicio o tus servicios. Las etiquetas de red se especifican a nivel de revisión. Cada revisión del servicio puede tener diferentes etiquetas de red, como network-tag-2.
En Enrutamiento del tráfico, selecciona una de las siguientes opciones:
Enruta solo las solicitudes a IP privadas a la VPC para enviar solo tráfico a direcciones internas a través de la red de VPC.
Enruta todo el tráfico a la VPC para enviar todo el tráfico saliente a través de la red de VPC.
Haz clic en Actualizar.
Para verificar que tu trabajo esté en la red de VPC, haz clic en
el trabajo y, luego, en la pestaña Configuración. Las redes y las subredes se detallan en la tarjeta VPC.
Ahora puedes ejecutar el trabajo de Cloud Run y enviar solicitudes desde el trabajo a cualquier recurso en la red de VPC, como lo permiten las reglas de firewall.
gcloud
Para migrar un trabajo de Cloud Run de un conector a una salida de VPC
directa a través de Google Cloud CLI, haz lo siguiente:
Actualiza tu trabajo de Cloud Run con el siguiente comando:
SUBNET por el nombre de la subred Puedes implementar o ejecutar varios servicios o trabajos en la misma subred.
Opcional: NETWORK_TAG_NAMES por los nombres de las etiquetas de red que deseas asociar con un trabajo. Para los trabajos, las etiquetas de red se especifican a nivel de ejecución. Cada ejecución de trabajo puede tener diferentes etiquetas de red, como network-tag-2.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2024-12-05 (UTC)"],[],[],null,["# Migrate standard VPC connector to Direct VPC egress\n\nThis page is for networking specialists who want to migrate standard VPC\nnetwork traffic from using [Serverless VPC Access connectors](/run/docs/configuring/vpc-connectors)\nto using [Direct VPC egress](/run/docs/configuring/vpc-direct-vpc)\nwhen sending traffic to a VPC network.\n\nDirect VPC egress is faster and can handle more traffic than connectors,\ndelivering lower latency and higher throughput because it uses a new, direct\nnetwork path rather than connector instances.\n\nBefore migration, we recommend that you familiarize yourself with Direct VPC\negress [prerequisites](/run/docs/configuring/vpc-direct-vpc#before_you_begin),\n[limitations](/run/docs/configuring/vpc-direct-vpc#limitations),\n[IP address allocation](/run/docs/configuring/vpc-direct-vpc#direct-vpc-ip-allocation),\nand [IAM permissions](/run/docs/configuring/vpc-direct-vpc#set_up_iam_permissions).\n\nMigrate services to Direct VPC egress\n-------------------------------------\n\n| **Important:** Connectors continue to incur charges even if they have no traffic and are disconnected. For details, see [pricing](/vpc/pricing#serverless-vpc-pricing). If you no longer need your connector, be sure to [delete](/run/docs/configuring/vpc-connectors#delete) it to avoid continued billing.\n\nMigrate services to Direct VPC egress gradually\n-----------------------------------------------\n\nWhen you migrate Cloud Run services from Serverless VPC Access\nconnectors to Direct VPC egress, we recommend that you do so in a gradual\ntransition.\n\nTo transition gradually:\n\n1. Follow the instructions in this section to update your service to use Direct VPC egress.\n2. [Split a small percentage of traffic](/run/docs/rollouts-rollbacks-traffic-migration#split-traffic) to determine whether the traffic works correctly.\n3. Update the traffic split to send all traffic to the new revision using Direct VPC egress.\n\nTo migrate traffic with Direct VPC egress for a service, use the\nGoogle Cloud console or Google Cloud CLI: \n\n### Console\n\n1. In the Google Cloud console, go to the **Cloud Run** page.\n\n [Go to Cloud Run](https://console.cloud.google.com/run)\n2. Click the service that you want to migrate from a connector to Direct\n VPC egress, then click **Edit and deploy new revision**.\n\n3. Click the **Networking** tab.\n\n4. From **Connect to a VPC for outbound traffic** , click **Send traffic directly to a VPC**.\n\n5. In the **Network** field, select the VPC\n network that you want to send traffic to.\n\n6. In the **Subnet** field, select the subnet where your service receives IP\n addresses from. You can deploy multiple services on the same subnet.\n\n7. Optional: Enter the names of the [network tags](/vpc/docs/add-remove-network-tags#restrictions)\n that you want to associate with your service or services. Network tags are\n specified at the revision-level. Each service revision can have different\n network tags, such as `network-tag-2`.\n\n8. For **Traffic routing**, select one of the following:\n\n - **Route only requests to private IPs to the VPC** to send only traffic to internal addresses through the VPC network.\n - **Route all traffic to the VPC** to send all outbound traffic through the VPC network.\n9. Click **Deploy**.\n\n10. To verify that your service is on your VPC network, click\n the service, then click the **Networking** tab. The network and subnet\n are listed in the **VPC** card.\n\n You can now send requests directly from your Cloud Run service to\n any resource on the VPC network, as allowed by your\n firewall rules.\n\n### gcloud\n\n\nTo migrate a Cloud Run service from a connector to Direct VPC\negress using the Google Cloud CLI:\n\n1. Update your Cloud Run service with the following command:\n\n ```bash\n gcloud run services update SERVICE_NAME \\\n --clear-vpc-connector \\\n --network=NETWORK \\\n --subnet=SUBNET \\\n --network-tags=NETWORK_TAG_NAMES \\\n --vpc-egress=EGRESS_SETTING \\\n --region=REGION\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the name of your service.\n - \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e with the name of your VPC network.\n - \u003cvar translate=\"no\"\u003eSUBNET\u003c/var\u003e with the name of your subnet. You can deploy or execute multiple services or jobs on the same subnet.\n - Optional: \u003cvar translate=\"no\"\u003eNETWORK_TAG_NAMES\u003c/var\u003e with the comma-separated names of the [network tags](/vpc/docs/add-remove-network-tags#restrictions) you want to associate with a service. For services, network tags are specified at the revision-level. Each service revision can have different network tags, such as `network-tag-2`.\n - \u003cvar translate=\"no\"\u003eEGRESS_SETTING\u003c/var\u003e with an [egress setting value](/sdk/gcloud/reference/run/deploy#--vpc-egress):\n - `all-traffic`: Sends all outbound traffic through the VPC network.\n - `private-ranges-only`: Sends only traffic to internal addresses through the VPC network.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with a region for your service.\n2. To verify that your service is on your VPC network, run\n the following command:\n\n ```bash\n gcloud run services describe SERVICE_NAME \\\n --region=REGION\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the name of your service.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region for your service that you specified in the previous step.\n\n The output should contain the name of your network, subnet, and egress\n setting, for example: \n\n VPC access:\n Network: default\n Subnet: subnet\n Egress: private-ranges-only\n\nYou can now send requests from your Cloud Run service to any\nresource on the VPC network, as allowed by your firewall\nrules.\n\nMigrate jobs to Direct VPC egress\n---------------------------------\n\n| **Important:** Connectors continue to incur charges even if they have no traffic and are disconnected. For details, see [pricing](/vpc/pricing#serverless-vpc-pricing). If you no longer need your connector, be sure to [delete](/run/docs/configuring/vpc-connectors#delete) it to avoid continued billing.\n\nYou can migrate traffic with Direct VPC egress for a job by using the\nGoogle Cloud console or Google Cloud CLI. \n\n### Console\n\n1. In the Google Cloud console, go to the **Cloud Run** page.\n\n [Go to Cloud Run](https://console.cloud.google.com/run)\n2. Click the job that you want to migrate from a connector to Direct\n VPC egress, then click **Edit**.\n\n3. Click the **Networking** tab.\n\n4. Click **Container, Variables \\& Secrets, Connections, Security** to\n expand the job properties page.\n\n5. Click the **Connections** tab.\n\n6. From **Connect to a VPC for outbound traffic** , click **Send traffic directly to a VPC**.\n\n7. In the **Network** field, select the VPC\n network that you want to send traffic to.\n\n8. In the **Subnet** field, select the subnet where your job receives IP\n addresses from. You can deploy multiple jobs on the same subnet.\n\n9. Optional: Enter the names of the [network tags](/vpc/docs/add-remove-network-tags#restrictions)\n that you want to associate with your service or services. Network tags are\n specified at the revision-level. Each service revision can have different\n network tags, such as `network-tag-2`.\n\n10. For **Traffic routing**, select one of the following:\n\n - **Route only requests to private IPs to the VPC** to send only traffic to internal addresses through the VPC network.\n - **Route all traffic to the VPC** to send all outbound traffic through the VPC network.\n11. Click **Update**.\n\n12. To verify that your job is on your VPC network, click\n the job, then click the **Configuration** tab. The network and subnet are\n listed in the **VPC** card.\n\nYou can now execute your Cloud Run job and send requests from the\njob to any resource on the VPC network, as allowed by your\nfirewall rules.\n\n### gcloud\n\n\nTo migrate a Cloud Run job from a connector to Direct VPC\negress using the Google Cloud CLI:\n\n1. Update your Cloud Run job with the following command:\n\n ```bash\n gcloud run jobs update JOB_NAME \\\n --clear-network \\\n --image=IMAGE_URL \\\n --network=NETWORK \\\n --subnet=SUBNET \\\n --network-tags=NETWORK_TAG_NAMES \\\n --vpc-egress=EGRESS_SETTING \\\n --region=REGION\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eJOB_NAME\u003c/var\u003e with the name of your job.\n - \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e with the name of your VPC network.\n - \u003cvar translate=\"no\"\u003eSUBNET\u003c/var\u003e with the name of your subnet. You can deploy or execute multiple services or jobs on the same subnet.\n - Optional: \u003cvar translate=\"no\"\u003eNETWORK_TAG_NAMES\u003c/var\u003e with the names of the [network tags](/vpc/docs/add-remove-network-tags#restrictions) you want to associate with a job. For jobs, network tags are specified at the execution-level. Each job execution can have different network tags, such as `network-tag-2`.\n - \u003cvar translate=\"no\"\u003eEGRESS_SETTING\u003c/var\u003e with an [egress setting value](/sdk/gcloud/reference/run/deploy#--vpc-egress):\n - `all-traffic`: Sends all outbound traffic through the VPC network.\n - `private-ranges-only`: Sends only traffic to internal addresses through the VPC network.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with a region for your job.\n2. To verify that your job is on your VPC network, run\n the following command:\n\n ```bash\n gcloud run jobs describe JOB_NAME \\\n --region=REGION\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eJOB_NAME\u003c/var\u003e with the name of your job.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region for your job that you specified in the previous step.\n\n The output should contain the name of your network, subnet, and egress\n setting, for example: \n\n VPC access:\n Network: default\n Subnet: subnet\n Egress: private-ranges-only\n\nYou can now send requests from your Cloud Run job to any\nresource on the VPC network, as allowed by your firewall\nrules."]]
