{
  "slug": "gcloud-functions-deploy-accepts-all-traffic-for-direct-vpc-egress-1613de113cd5",
  "title": "gcloud functions deploy accepts all-traffic for direct VPC egress",
  "tools": [
    "gcloud"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-08-04T00:00:00.000Z",
  "announced_at": "2026-08-04T00:00:00.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "For a 2nd gen Cloud Function that should route all outbound traffic through its VPC, deploy with `--direct-vpc-egress=all-traffic` and configure a VPC network or subnet. [Google Cloud Direct VPC egress guide](https://docs.cloud.google.com/functions/docs/running/direct-vpc?hl=en)",
    "examples": [
      "gcloud functions deploy <FUNCTION_NAME> --source . --runtime <RUNTIME> --trigger-http --region <REGION> --network=<NETWORK> --subnet=<SUBNET> --direct-vpc-egress=all-traffic"
    ],
    "gotchas": [
      "<FUNCTION_NAME> (required): Function name.",
      "--runtime (required): Runtime; required for a new function.",
      "--region (required): Region where the function is deployed.",
      "--source: Source location; `.` uses the current directory. The Direct VPC example includes it.",
      "--trigger-http: Configures an HTTP trigger. The Direct VPC deployment example includes it.",
      "--network: VPC network the function can send traffic to. Specify a network, a subnet, or both; when only a network is specified, the subnet uses the same name.",
      "--subnet: VPC subnetwork from which the function gets IPs. Specify a network, a subnet, or both.",
      "--direct-vpc-egress: Selects outbound traffic routed through Direct VPC egress. Allowed values in the command reference include `private-ranges-only`, `all`, and `all-traffic`; the card’s `all-traffic` value is the requested setting.",
      "Prerequisite: Direct VPC egress requires a 2nd gen function; it is unavailable for 1st gen. Enable the Cloud Functions API, install and initialize the Google Cloud CLI, and update it to version 558.0.0 or later.",
      "Prerequisite: A VPC network must exist. To authorize Direct VPC egress, the function service account needs `roles/run.invoker`; the Cloud Run service agent must also have VPC access, by its default role or the documented alternative permissions.",
      "Prerequisite: Direct VPC egress and Serverless VPC Access connectors cannot be used at the same time.",
      "Docs conflict: The current command reference lists `all-traffic` as an allowed value, while the Direct VPC guide updated 2026-09-22 documents `all` as the all-outbound-traffic value and does not list `all-traffic`. The later guide differs from the release note; its value was not substituted."
    ]
  },
  "why_it_matters": "Deploy a Cloud Function with direct VPC egress configured for all traffic.",
  "sources": [
    "https://docs.cloud.google.com/sdk/docs/release-notes#57900_2026-08-04",
    "https://docs.cloud.google.com/functions/docs/running/direct-vpc?hl=en",
    "https://docs.cloud.google.com/sdk/gcloud/reference/functions/deploy"
  ],
  "rank": 0.92029,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v1+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "cloud-20261008",
    "verdict_id": "cloud-20261008:cloud-20261008-eb235a632934177d-4:gate",
    "evidence_hash": "dd37dddad141709b13c3129bdff0b394c937cacc40b42cee3aff73991770f2a5"
  },
  "review": {
    "draft_hash": "6116b5b5bb7a3f45ed7fe711a14c6dd2cb1a6175a8bbe35752c4ace0f7bf37f2",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "cloud-20261008:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.92 >= 0.9; 2 needed) and Jev gave 0.62 (>= 0.6 needed)."
  }
}