Support Direct VPC Egress for 2nd gen Cloud Functions

[Rohit1024]

TL;DR

Add input parameters to configure Direct VPC Egress (network, subnet, network_tags, and direct_vpc_egress) on Cloud Functions (2nd gen) without requiring a Serverless VPC Access connector.

Detailed design

Expected Behavior / Use Case

Google Cloud Functions (2nd gen) supports Direct VPC Egress, allowing functions to send outbound traffic directly to a VPC network. This improves throughput, lowers latency, avoids the cost and scaling limits of Serverless VPC Access connectors, and enables network tags for granular firewall targeting.

Currently, deploy-cloud-functions only exposes vpc_connector and vpc_connector_egress_settings. Teams adopting Direct VPC Egress must bypass this action entirely and fall back to manual CLI commands via gcloud functions deploy.

Detailed Design

Proposed Action Inputs

Add the following optional inputs to action.yml:

Input	Type	Description
network	string	The VPC network name or fully qualified resource URL.
subnet	string	The VPC subnetwork name or fully qualified resource URL.
network_tags	string	Comma-separated list of network tags to attach to egress traffic (e.g., tag-a,tag-b).
direct_vpc_egress	string	Outbound traffic setting. Allowed values: all-traffic, private-ranges-only.

API & Implementation Considerations

• Cloud Functions v2 API Mapping: Translate these inputs into the underlying ServiceConfig network interface configuration (serviceConfig.networkConfig.networkInterfaces).
• Validation & Mutex:
  • Direct VPC Egress is only supported on Cloud Functions 2nd gen. Throw a descriptive client error if network/subnet is supplied while deploying a 1st gen function.
  • Validate mutual exclusivity between vpc_connector and direct VPC network inputs (network/subnet) to prevent conflicting egress configurations.

Example Workflow

- name: Deploy Cloud Function with Direct VPC Egress
  uses: google-github-actions/deploy-cloud-functions@v3
  with:
    name: 'my-service'
    runtime: 'nodejs20'
    region: 'us-central1'
    source_dir: '.'
    network: 'default'
    subnet: 'default'
    network_tags: 'internal-egress,db-client'
    direct_vpc_egress: 'private-ranges-only'

Workaround Today

Users currently configure google-github-actions/setup-gcloud and run native gcloud functions deploy CLI commands with the --network, --subnet, and --direct-vpc-egress flags:

- name: Authenticate to Google Cloud
  uses: google-github-actions/auth@v2
  with:
    credentials_json: ${{ secrets.GCP_SA_KEY }}

- name: Set up Cloud SDK
  uses: google-github-actions/setup-gcloud@v2

- name: Deploy Cloud Function with Direct VPC Egress
  run: |
    gcloud functions deploy my-service \
      --gen2 \
      --region us-central1 \
      --runtime nodejs20 \
      --source . \
      --entry-point app \
      --trigger-http \
      --network=default \
      --subnet=default \
      --network-tags=internal-egress,db-client \
      --direct-vpc-egress=private-ranges-only

Additional information

• GCP Documentation:
  • Connect to a VPC network using Direct VPC egress (Cloud Functions)