Memigrasikan konektor VPC standar ke traffic keluar VPC Langsung
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini ditujukan untuk spesialis jaringan yang ingin memigrasikan traffic jaringan VPC standar dari penggunaan konektor Akses VPC Serverless ke penggunaan traffic keluar VPC Langsung saat mengirim traffic ke jaringan VPC.
Egress VPC langsung lebih cepat dan dapat menangani lebih banyak traffic daripada konektor,
yang memberikan latensi lebih rendah dan throughput lebih tinggi karena menggunakan jalur jaringan langsung
baru, bukan instance konektor.
Memigrasikan layanan ke traffic keluar VPC Langsung
Memigrasikan layanan ke traffic keluar VPC Langsung secara bertahap
Saat memigrasikan layanan Cloud Run dari konektor Akses VPC Serverless ke traffic keluar VPC Langsung, sebaiknya Anda melakukannya dalam transisi bertahap.
Untuk melakukan transisi secara bertahap:
Ikuti petunjuk di bagian ini untuk mengupdate layanan Anda agar menggunakan
traffic keluar VPC Langsung.
Klik layanan yang ingin Anda migrasikan dari konektor ke egress VPC Direct, lalu klik Edit dan deploy revisi baru.
Klik tab Networking.
Dari Menghubungkan ke VPC untuk traffic keluar, klik Kirim traffic langsung ke VPC.
Di kolom Network, pilih jaringan
VPC yang ingin Anda kirimi traffic.
Di kolom Subnet, pilih subnet tempat alamat IP diterima oleh
layanan Anda. Anda dapat men-deploy beberapa layanan di subnet yang sama.
Opsional: Masukkan nama tag jaringan
yang ingin dikaitkan dengan layanan Anda atau layanan lainnya. Tag jaringan
ditentukan pada tingkat revisi. Setiap revisi layanan dapat memiliki tag jaringan
yang berbeda, seperti network-tag-2.
Untuk Pemilihan rute traffic, pilih salah satu opsi berikut:
Rutekan hanya permintaan IP pribadi ke VPC untuk hanya mengirim
traffic ke alamat internal melalui jaringan VPC.
Rutekan semua traffic ke VPC untuk mengirim semua traffic keluar
melalui jaringan VPC.
Klik Deploy.
Untuk memverifikasi bahwa layanan Anda berada di jaringan VPC, klik
layanan tersebut, lalu klik tab Networking. Jaringan dan subnet
tercantum dalam kartu VPC.
Kini Anda dapat mengirim permintaan langsung dari layanan Cloud Run ke
resource mana pun di jaringan VPC, sebagaimana diizinkan oleh
aturan firewall Anda.
gcloud
Untuk memigrasikan layanan Cloud Run dari konektor ke traffic keluar VPC Langsung menggunakan Google Cloud CLI:
Perbarui layanan Cloud Run Anda dengan perintah berikut:
SUBNET dengan nama subnet Anda. Anda dapat men-deploy atau menjalankan beberapa layanan atau tugas di subnet yang sama.
Opsional: NETWORK_TAG_NAMES dengan nama tag jaringan yang dipisahkan
koma yang ingin Anda kaitkan
dengan layanan. Untuk layanan, tag jaringan
ditentukan pada tingkat revisi. Setiap revisi jaringan dapat memiliki
tag jaringan yang berbeda, seperti network-tag-2.
Dari Menghubungkan ke VPC untuk traffic keluar, klik Kirim traffic langsung ke VPC.
Di kolom Network, pilih jaringan
VPC yang ingin Anda kirimi traffic.
Di kolom Subnet, pilih subnet tempat alamat IP diterima oleh
tugas Anda. Anda dapat men-deploy beberapa tugas di subnet yang sama.
Opsional: Masukkan nama tag jaringan
yang ingin dikaitkan dengan layanan Anda atau layanan lainnya. Tag jaringan
ditentukan pada tingkat revisi. Setiap revisi layanan dapat memiliki tag jaringan
yang berbeda, seperti network-tag-2.
Untuk Pemilihan rute traffic, pilih salah satu opsi berikut:
Rutekan hanya permintaan IP pribadi ke VPC untuk hanya mengirim
traffic ke alamat internal melalui jaringan VPC.
Rutekan semua traffic ke VPC untuk mengirim semua traffic keluar
melalui jaringan VPC.
Klik Perbarui.
Untuk memverifikasi bahwa tugas Anda berada di jaringan VPC, klik
tugas tersebut, lalu klik tab Konfigurasi. Jaringan dan subnet
tercantum dalam kartuVPC.
Sekarang Anda dapat menjalankan tugas Cloud Run dan mengirim permintaan
dari tugas ke resource mana pun di jaringan VPC, sebagaimana diizinkan oleh
aturan firewall Anda.
gcloud
Untuk memigrasikan tugas Cloud Run dari konektor ke traffic keluar VPC Langsung menggunakan Google Cloud CLI:
Perbarui tugas Cloud Run Anda dengan perintah berikut:
SUBNET dengan nama subnet Anda. Anda dapat men-deploy atau menjalankan beberapa layanan atau tugas di subnet yang sama.
Opsional: NETWORK_TAG_NAMES dengan nama
tag jaringan
yang ingin Anda kaitkan dengan tugas. Untuk tugas, tag jaringan ditentukan
pada tingkat eksekusi. Setiap eksekusi tugas dapat memiliki tag jaringan
yang berbeda, seperti network-tag-2.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Migrate standard VPC connector to Direct VPC egress\n\nThis page is for networking specialists who want to migrate standard VPC\nnetwork traffic from using [Serverless VPC Access connectors](/run/docs/configuring/vpc-connectors)\nto using [Direct VPC egress](/run/docs/configuring/vpc-direct-vpc)\nwhen sending traffic to a VPC network.\n\nDirect VPC egress is faster and can handle more traffic than connectors,\ndelivering lower latency and higher throughput because it uses a new, direct\nnetwork path rather than connector instances.\n\nBefore migration, we recommend that you familiarize yourself with Direct VPC\negress [prerequisites](/run/docs/configuring/vpc-direct-vpc#before_you_begin),\n[limitations](/run/docs/configuring/vpc-direct-vpc#limitations),\n[IP address allocation](/run/docs/configuring/vpc-direct-vpc#direct-vpc-ip-allocation),\nand [IAM permissions](/run/docs/configuring/vpc-direct-vpc#set_up_iam_permissions).\n\nMigrate services to Direct VPC egress\n-------------------------------------\n\n| **Important:** Connectors continue to incur charges even if they have no traffic and are disconnected. For details, see [pricing](/vpc/pricing#serverless-vpc-pricing). If you no longer need your connector, be sure to [delete](/run/docs/configuring/vpc-connectors#delete) it to avoid continued billing.\n\nMigrate services to Direct VPC egress gradually\n-----------------------------------------------\n\nWhen you migrate Cloud Run services from Serverless VPC Access\nconnectors to Direct VPC egress, we recommend that you do so in a gradual\ntransition.\n\nTo transition gradually:\n\n1. Follow the instructions in this section to update your service to use Direct VPC egress.\n2. [Split a small percentage of traffic](/run/docs/rollouts-rollbacks-traffic-migration#split-traffic) to determine whether the traffic works correctly.\n3. Update the traffic split to send all traffic to the new revision using Direct VPC egress.\n\nTo migrate traffic with Direct VPC egress for a service, use the\nGoogle Cloud console or Google Cloud CLI: \n\n### Console\n\n1. In the Google Cloud console, go to the **Cloud Run** page.\n\n [Go to Cloud Run](https://console.cloud.google.com/run)\n2. Click the service that you want to migrate from a connector to Direct\n VPC egress, then click **Edit and deploy new revision**.\n\n3. Click the **Networking** tab.\n\n4. From **Connect to a VPC for outbound traffic** , click **Send traffic directly to a VPC**.\n\n5. In the **Network** field, select the VPC\n network that you want to send traffic to.\n\n6. In the **Subnet** field, select the subnet where your service receives IP\n addresses from. You can deploy multiple services on the same subnet.\n\n7. Optional: Enter the names of the [network tags](/vpc/docs/add-remove-network-tags#restrictions)\n that you want to associate with your service or services. Network tags are\n specified at the revision-level. Each service revision can have different\n network tags, such as `network-tag-2`.\n\n8. For **Traffic routing**, select one of the following:\n\n - **Route only requests to private IPs to the VPC** to send only traffic to internal addresses through the VPC network.\n - **Route all traffic to the VPC** to send all outbound traffic through the VPC network.\n9. Click **Deploy**.\n\n10. To verify that your service is on your VPC network, click\n the service, then click the **Networking** tab. The network and subnet\n are listed in the **VPC** card.\n\n You can now send requests directly from your Cloud Run service to\n any resource on the VPC network, as allowed by your\n firewall rules.\n\n### gcloud\n\n\nTo migrate a Cloud Run service from a connector to Direct VPC\negress using the Google Cloud CLI:\n\n1. Update your Cloud Run service with the following command:\n\n ```bash\n gcloud run services update SERVICE_NAME \\\n --clear-vpc-connector \\\n --network=NETWORK \\\n --subnet=SUBNET \\\n --network-tags=NETWORK_TAG_NAMES \\\n --vpc-egress=EGRESS_SETTING \\\n --region=REGION\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the name of your service.\n - \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e with the name of your VPC network.\n - \u003cvar translate=\"no\"\u003eSUBNET\u003c/var\u003e with the name of your subnet. You can deploy or execute multiple services or jobs on the same subnet.\n - Optional: \u003cvar translate=\"no\"\u003eNETWORK_TAG_NAMES\u003c/var\u003e with the comma-separated names of the [network tags](/vpc/docs/add-remove-network-tags#restrictions) you want to associate with a service. For services, network tags are specified at the revision-level. Each service revision can have different network tags, such as `network-tag-2`.\n - \u003cvar translate=\"no\"\u003eEGRESS_SETTING\u003c/var\u003e with an [egress setting value](/sdk/gcloud/reference/run/deploy#--vpc-egress):\n - `all-traffic`: Sends all outbound traffic through the VPC network.\n - `private-ranges-only`: Sends only traffic to internal addresses through the VPC network.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with a region for your service.\n2. To verify that your service is on your VPC network, run\n the following command:\n\n ```bash\n gcloud run services describe SERVICE_NAME \\\n --region=REGION\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the name of your service.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region for your service that you specified in the previous step.\n\n The output should contain the name of your network, subnet, and egress\n setting, for example: \n\n VPC access:\n Network: default\n Subnet: subnet\n Egress: private-ranges-only\n\nYou can now send requests from your Cloud Run service to any\nresource on the VPC network, as allowed by your firewall\nrules.\n\nMigrate jobs to Direct VPC egress\n---------------------------------\n\n| **Important:** Connectors continue to incur charges even if they have no traffic and are disconnected. For details, see [pricing](/vpc/pricing#serverless-vpc-pricing). If you no longer need your connector, be sure to [delete](/run/docs/configuring/vpc-connectors#delete) it to avoid continued billing.\n\nYou can migrate traffic with Direct VPC egress for a job by using the\nGoogle Cloud console or Google Cloud CLI. \n\n### Console\n\n1. In the Google Cloud console, go to the **Cloud Run** page.\n\n [Go to Cloud Run](https://console.cloud.google.com/run)\n2. Click the job that you want to migrate from a connector to Direct\n VPC egress, then click **Edit**.\n\n3. Click the **Networking** tab.\n\n4. Click **Container, Variables \\& Secrets, Connections, Security** to\n expand the job properties page.\n\n5. Click the **Connections** tab.\n\n6. From **Connect to a VPC for outbound traffic** , click **Send traffic directly to a VPC**.\n\n7. In the **Network** field, select the VPC\n network that you want to send traffic to.\n\n8. In the **Subnet** field, select the subnet where your job receives IP\n addresses from. You can deploy multiple jobs on the same subnet.\n\n9. Optional: Enter the names of the [network tags](/vpc/docs/add-remove-network-tags#restrictions)\n that you want to associate with your service or services. Network tags are\n specified at the revision-level. Each service revision can have different\n network tags, such as `network-tag-2`.\n\n10. For **Traffic routing**, select one of the following:\n\n - **Route only requests to private IPs to the VPC** to send only traffic to internal addresses through the VPC network.\n - **Route all traffic to the VPC** to send all outbound traffic through the VPC network.\n11. Click **Update**.\n\n12. To verify that your job is on your VPC network, click\n the job, then click the **Configuration** tab. The network and subnet are\n listed in the **VPC** card.\n\nYou can now execute your Cloud Run job and send requests from the\njob to any resource on the VPC network, as allowed by your\nfirewall rules.\n\n### gcloud\n\n\nTo migrate a Cloud Run job from a connector to Direct VPC\negress using the Google Cloud CLI:\n\n1. Update your Cloud Run job with the following command:\n\n ```bash\n gcloud run jobs update JOB_NAME \\\n --clear-network \\\n --image=IMAGE_URL \\\n --network=NETWORK \\\n --subnet=SUBNET \\\n --network-tags=NETWORK_TAG_NAMES \\\n --vpc-egress=EGRESS_SETTING \\\n --region=REGION\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eJOB_NAME\u003c/var\u003e with the name of your job.\n - \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e with the name of your VPC network.\n - \u003cvar translate=\"no\"\u003eSUBNET\u003c/var\u003e with the name of your subnet. You can deploy or execute multiple services or jobs on the same subnet.\n - Optional: \u003cvar translate=\"no\"\u003eNETWORK_TAG_NAMES\u003c/var\u003e with the names of the [network tags](/vpc/docs/add-remove-network-tags#restrictions) you want to associate with a job. For jobs, network tags are specified at the execution-level. Each job execution can have different network tags, such as `network-tag-2`.\n - \u003cvar translate=\"no\"\u003eEGRESS_SETTING\u003c/var\u003e with an [egress setting value](/sdk/gcloud/reference/run/deploy#--vpc-egress):\n - `all-traffic`: Sends all outbound traffic through the VPC network.\n - `private-ranges-only`: Sends only traffic to internal addresses through the VPC network.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with a region for your job.\n2. To verify that your job is on your VPC network, run\n the following command:\n\n ```bash\n gcloud run jobs describe JOB_NAME \\\n --region=REGION\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eJOB_NAME\u003c/var\u003e with the name of your job.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region for your job that you specified in the previous step.\n\n The output should contain the name of your network, subnet, and egress\n setting, for example: \n\n VPC access:\n Network: default\n Subnet: subnet\n Egress: private-ranges-only\n\nYou can now send requests from your Cloud Run job to any\nresource on the VPC network, as allowed by your firewall\nrules."]]
