Skip to main content
Supported Regions:上海

VPC Configuration

After you enable private network for a CloudRun service, service instances can join a specified Tencent Cloud VPC and subnet. After joining the VPC, requests from the service to resources inside the VPC use the private network path. This is useful for accessing cloud databases, Redis, CVM, Lighthouse instances, or business services connected across VPCs.

Use cases​

Configure VPC in the following scenarios:

  • The CloudRun service needs to access Tencent Cloud resources such as MySQL, Redis, CVM, or Lighthouse through the private network.
  • The service needs to access resources in another VPC connected through CCN or peering connection.
  • You want to disable the default public egress and route outbound traffic through your own VPC network.
  • You need to use VPC capabilities such as NAT gateway, route tables, or security groups.

If you only need calls between CloudRun services, see Intranet Access. To access other VPC resources under your account, use this together with Intranet Connectivity.

Prerequisites​

Before configuring VPC, make sure:

  • A VPC and subnet have been created in the Tencent Cloud VPC console.
  • The VPC is in the same region as the CloudRun service.
  • The subnet has enough allocatable IP addresses, so instances can restart or scale out successfully.
  • If the service needs public network access, the VPC has a NAT gateway and corresponding route configured.
Subnet planning

CloudRun instances consume subnet IP addresses after joining a VPC. For production environments, reserve a dedicated subnet for CloudRun instead of sharing a small subnet with databases, CVM instances, or other resources.

Configure VPC​

You can configure VPC when creating a service, or update it after the service is created.

Configure when creating a service​

  1. Go to the CloudBase Platform and select the target environment.
  2. Go to CloudRun and create or deploy a service.
  3. Enable "Private Network" in the network configuration.
  4. Select the VPC and subnet to join.
  5. Complete the remaining deployment configuration and submit.

After deployment, the instances join the selected VPC and can access reachable resources inside that VPC.

Configure an existing service​

  1. Go to the CloudRun service details page.
  2. Open "Service Settings".
  3. Enable or edit "Private Network" in the network configuration.
  4. Select the VPC and subnet, then save.
  5. Wait until the service update is complete.

Changing VPC configuration triggers a service update. Perform this operation during off-peak hours when possible, and verify service access and dependency connectivity after the update.

Access VPC resources​

After the service joins a VPC, application code usually accesses target resources through their private addresses, for example:

  • MySQL: use the database private connection address and port.
  • Redis: use the Redis private address and port.
  • CVM or Lighthouse: use the instance private IP or private domain name.

If the target resource uses security groups, allowlists, or access control policies, allow access from the VPC or subnet used by the CloudRun service.

Public egress​

Enabling private network does not automatically provide public egress. If instances still need to access the public network after joining a VPC, make sure:

  • The VPC has a NAT gateway or another public egress capability.
  • The subnet route table forwards public traffic to the NAT gateway.
  • Security groups, firewalls, or target allowlists permit the egress traffic.

If you turn off "Public Network Access", the platform's default public egress is disabled, and outbound traffic from service instances is forwarded through the bound VPC network path.

Notes​

  • VPC or subnet changes affect the instance network environment. Confirm dependency resource addresses and route settings before saving.
  • Insufficient subnet IP addresses may cause instance startup, scaling, or version release failures.
  • Before accessing cross-account or cross-VPC resources, connect the networks through CCN, peering connection, or a similar method.
  • When accessing databases or caches, use private addresses to avoid latency and security risks caused by public network access.