gcloud functions deploy accepts all-traffic for direct VPC egress

Introduced 2026-08-04 · score 0.92

HOW TO USE IT

For a 2nd gen Cloud Function that should route all outbound traffic through its VPC, deploy with `--direct-vpc-egress=all-traffic` and configure a VPC network or subnet. [Google Cloud Direct VPC egress guide](https://docs.cloud.google.com/functions/docs/running/direct-vpc?hl=en)

WHY THIS HELPS

Deploy a Cloud Function with direct VPC egress configured for all traffic.

REQUIREMENTS AND LIMITATIONS

• <FUNCTION_NAME> (required): Function name.
• --runtime (required): Runtime; required for a new function.
• --region (required): Region where the function is deployed.
• --source: Source location; `.` uses the current directory. The Direct VPC example includes it.
• --trigger-http: Configures an HTTP trigger. The Direct VPC deployment example includes it.
• --network: VPC network the function can send traffic to. Specify a network, a subnet, or both; when only a network is specified, the subnet uses the same name.
• --subnet: VPC subnetwork from which the function gets IPs. Specify a network, a subnet, or both.
• --direct-vpc-egress: Selects outbound traffic routed through Direct VPC egress. Allowed values in the command reference include `private-ranges-only`, `all`, and `all-traffic`; the card’s `all-traffic` value is the requested setting.
• Prerequisite: Direct VPC egress requires a 2nd gen function; it is unavailable for 1st gen. Enable the Cloud Functions API, install and initialize the Google Cloud CLI, and update it to version 558.0.0 or later.
• Prerequisite: A VPC network must exist. To authorize Direct VPC egress, the function service account needs `roles/run.invoker`; the Cloud Run service agent must also have VPC access, by its default role or the documented alternative permissions.
• Prerequisite: Direct VPC egress and Serverless VPC Access connectors cannot be used at the same time.
• Docs conflict: The current command reference lists `all-traffic` as an allowed value, while the Direct VPC guide updated 2026-09-22 documents `all` as the all-outbound-traffic value and does not list `all-traffic`. The later guide differs from the release note; its value was not substituted.

FIRST-PARTY EVIDENCE

• https://docs.cloud.google.com/sdk/docs/release-notes#57900_2026-08-04
• https://docs.cloud.google.com/functions/docs/running/direct-vpc?hl=en
• https://docs.cloud.google.com/sdk/gcloud/reference/functions/deploy

Check the installed version and the source before using it. Entry JSON

Report a problem with this card