Skip to content

feat: add support for VPC direct connect#299

Open
IzaakGough wants to merge 2 commits into
mainfrom
@invertase/feat-add-support-for-VPC-direct-connect
Open

feat: add support for VPC direct connect#299
IzaakGough wants to merge 2 commits into
mainfrom
@invertase/feat-add-support-for-VPC-direct-connect

Conversation

@IzaakGough

@IzaakGough IzaakGough commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

Fixes #275

This PR adds support for VPC direct connect. These additions help to maintain parity between the Python and JS SDKs.

Testing

Deployed the following function:

from flask import Request, Response, make_response
from firebase_functions import https_fn, options

@https_fn.on_request(
    region="us-central1",
    network_interface=options.NetworkInterface(
        network="default",
        subnetwork="default",
    ),
    vpc_egress=options.VpcEgressSetting.PRIVATE_RANGES_ONLY,
  )
def vpcprobe(request: Request) -> Response:
    return make_response("ok", 200)

Ran

gcloud run services describe vpcprobe --region=us-central1 --format export

Output included:

run.googleapis.com/network-interfaces: '[{"network":"default","subnetwork":"default"}]'
run.googleapis.com/vpc-access-egress: private-ranges-only

Then for the reset path:

Deployed:

from flask import Request, Response, make_response
from firebase_functions import https_fn, options

@https_fn.on_request(
    region="us-central1",
    network_interface=options.RESET_VALUE
  )
def vpcprobe(request: Request) -> Response:
    return make_response("ok", 200)

Ran

gcloud run services describe vpcprobe --region=us-central1 --format export

The following were no longer present in the output

run.googleapis.com/network-interfaces 
run.googleapis.com/vpc-access-egress 

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces support for Direct VPC Egress by adding a new NetworkInterface dataclass and a network_interface option to RuntimeOptions and global options. It also adds a vpc_egress alias for vpc_connector_egress_settings, updates manifest generation to handle these new settings, and includes comprehensive unit tests. The review feedback suggests a valuable simplification: removing the vpc_egress alias from resettable_options to avoid default RESET_VALUE population, which in turn simplifies the precedence logic in _endpoint() and allows the removal of an unnecessary test assertion.

Comment on lines 375 to 380
"service_account",
"vpc_connector",
"vpc_connector_egress_settings",
"vpc_egress",
"network_interface",
]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Since vpc_egress is an alias for vpc_connector_egress_settings, it does not need to be included in resettable_options. Including it causes it to be populated with RESET_VALUE by default when preserve_external_changes is False, which complicates the logic in _endpoint() and can lead to bugs where explicit overrides are ignored. Removing it allows for a much simpler and more robust override check.

            "service_account",
            "vpc_connector",
            "vpc_connector_egress_settings",
            "network_interface",
        ]

Comment on lines +422 to +426
vpc_egress = options.vpc_connector_egress_settings
if options.vpc_egress is not None and (
not isinstance(options.vpc_egress, _util.Sentinel) or vpc_egress is None
):
vpc_egress = options.vpc_egress

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

With vpc_egress removed from resettable_options, we can simplify this logic significantly. If options.vpc_egress is not None, it means the user explicitly specified it (either as a valid VpcEgressSetting or as RESET_VALUE). Therefore, we can let it take precedence over vpc_connector_egress_settings directly without complex type checks.

        vpc_egress = options.vpc_connector_egress_settings
        if options.vpc_egress is not None:
            vpc_egress = options.vpc_egress

Comment thread tests/test_options.py
Comment on lines +166 to +169
assert options_asdict["network_interface"] is options.RESET_VALUE, (
"network_interface should be RESET_VALUE"
)
assert options_asdict["vpc_egress"] is options.RESET_VALUE, "vpc_egress should be RESET_VALUE"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Since vpc_egress is no longer in resettable_options, it will not be populated with RESET_VALUE in options_asdict by default. We should remove this assertion.

Suggested change
assert options_asdict["network_interface"] is options.RESET_VALUE, (
"network_interface should be RESET_VALUE"
)
assert options_asdict["vpc_egress"] is options.RESET_VALUE, "vpc_egress should be RESET_VALUE"
assert options_asdict["network_interface"] is options.RESET_VALUE, (
"network_interface should be RESET_VALUE"
)

@IzaakGough IzaakGough marked this pull request as ready for review June 24, 2026 13:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add support for VPC direct connect

2 participants