Skip to content

Commit e99e402

Browse files
xortivexortive
authored
Update WVPC docs to discuss roles and runtime behavior (#26421)
1 parent 9340036 commit e99e402

File tree

5 files changed

+32
-11
lines changed

5 files changed

+32
-11
lines changed

‎src/content/docs/fundamentals/manage-members/roles.mdx‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,9 @@ Account-scoped roles apply across an entire Cloudflare account, and through all
7777
| Waiting Room Read | Can read [Waiting Room](/waiting-room/) configuration. |
7878
| Workers Platform Admin | Grants edit and read access to all products typically used as part of Cloudflare's Developer Platform, including [Workers](/workers/), [Pages](/pages/), [Durable Objects](/durable-objects/), [KV](/kv/), [R2](/r2/), Zones, [Zone Analytics](/analytics/account-and-zone-analytics/zone-analytics/) and [Page Rules](/rules/). Cloudflare may add additional read-only permissions to this role as new products are introduced. |
7979
| Workers Platform (Read-only) | Grants read-only access to all products typically used as part of Cloudflare's Developer Platform, including [Workers](/workers/), [Pages](/pages/), [Durable Objects](/durable-objects/), [KV](/kv/), [R2](/r2/), Zones, [Zone Analytics](/analytics/account-and-zone-analytics/zone-analytics/) and [Page Rules](/rules/). Cloudflare may add additional read-only permissions to this role as new products are introduced. |
80+
| Connectivity Directory Read | Can view [Workers VPC Services](/workers-vpc/) and [Cloudflare Tunnels](/workers-vpc/configuration/tunnel/).
81+
| Connectivity Directory Bind | Can read, list, and bind to [Workers VPC Services](/workers-vpc/), as well as read and list [Cloudflare Tunnels](/workers-vpc/configuration/tunnel/).
82+
| Connectivity Directory Admin | Can view, edit, create, and delete [Workers VPC Services](/workers-vpc/), including the ability to create VPC Services that bind to [Cloudflare Tunnel](/workers-vpc/configuration/tunnel/).
8083
| Zaraz Admin | Can edit and publish [Zaraz](/zaraz/) configuration. |
8184
| Zaraz Edit | Can edit [Zaraz](/zaraz/) configuration. |
8285
| Zaraz Read | Can read [Zaraz](/zaraz/) configuration. |

‎src/content/docs/workers-vpc/configuration/tunnel/index.mdx‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,9 @@ import { GlossaryTooltip, Tabs, TabItem, Example } from "~/components";
99

1010
Cloudflare Tunnel creates secure connections from your infrastructure to Cloudflare's global network, providing the network connectivity that allows Workers to access your private resources.
1111

12-
When you create a VPC Service, you specify a tunnel ID and target service. Workers VPC then routes requests from your Worker to the appropriate tunnel, forwards traffic to your private network, connects to the specified hostname or IP address, and returns responses back to your Worker.
12+
When you create a VPC Service, you specify a tunnel ID and target service. Workers VPC then routes requests from your Worker to the specified tunnel, which establishes a connection to the specified hostname or IP address, such that the target service receives the request and returns a response back to your Worker.
13+
14+
To allow members to create VPC Services that represent a target service reachable via a tunnel, you must assign them the **Connectivity Directory Admin** role. Members must possess **Connectivity Directory Bind** role to bind to existing VPC Services from worker.
1315

1416
The tunnel maintains persistent connections to Cloudflare, eliminating the need for inbound firewall rules or public IP addresses.
1517

‎src/content/docs/workers-vpc/configuration/vpc-services.mdx‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ You can use bindings to connect to VPC Services from Workers. Every request made
2020

2121
VPC Services enforce that requests are routed to their intended service without exposing the entire network, securing your workloads and preventing server-side request forgery (SSRF).
2222

23+
Members must possess **Connectivity Directory Bind** role to bind to existing VPC Services from Workers. Creating VPC Services requires members to possess the **Connectivity Directory Admin** role.
24+
2325
:::note
2426

2527
Workers VPC is currently in beta. Features and APIs may change before general availability. While in beta, Workers VPC is available for free to all Workers plans.
@@ -34,13 +36,24 @@ A VPC Service consists of:
3436
- **Tunnel ID**: The Cloudflare Tunnel that provides network connectivity
3537
- **Hostname or IPv4/IPv6 addresses**: The hostname, or IPv4 and/or IPv6 addresses to use to route to your service from the tunnel in your private network
3638
- **Ports**: HTTP and/or HTTPS port configuration (optional, defaults to 80/443)
39+
- **Resolver IPs**: Optionally, a specific resolver IP can be provided -- when not provided, `cloudflared` will direct DNS traffic to the currently configured default system resolver.
40+
41+
Requests are encrypted in flight until they reach your network via a tunnel, regardless of the scheme used in the URL provided to `fetch`. If the `http` scheme is used, a plaintext connection is established to the service from the tunnel.
42+
43+
The `https` scheme can be used for an encrypted connection within your network, between the tunnel and your service. When the `https` scheme is specified, a hostname provided to the `fetch()` operation is utilized as the Server Name Indication (SNI) value.
44+
45+
VPC Services default to allowing both `http` and `https` schemes to be used. You can provide values for only one of `http_port` or `https_port` to enforce the use of a particular scheme.
46+
47+
When Workers VPC is unable to establish a connection to your service, `fetch()` will throw an exception.
3748

3849
:::note
39-
The [VPC Service configurations](/workers-vpc/configuration/vpc-services/#vpc-service-configuration) will always be used to connect and route requests to your services in external networks, even if a different URL or host is present in the actual `fetch()` operation of the Worker code.
4050

41-
The host provided in the `fetch()` operation is not used to route requests, and instead only populates the `Host` field for a HTTP request that can be parsed by the server and used for Server Name Indication (SNI), when the `https` scheme is specified.
51+
The [VPC Service configuration](/workers-vpc/configuration/vpc-services/#vpc-service-configuration) host and port(s) will always be used to connect and route requests to your services, even if a different host or port is present in the URL provided to the `fetch()` operation in the Worker code.
52+
53+
The host provided in the `fetch()` operation is not used to route requests, and instead only populates the `Host` field for a HTTP request, or `Host` and the Server Name Indication (SNI) value presented to your service for a HTTPS request.
54+
55+
The port provided in the `fetch()` operation is ignored — the port specified in the VPC Service configuration for the provided scheme will be used.
4256

43-
The port provided in the `fetch()` operation is ignored — the port specified in the VPC Service configuration will be used.
4457
:::
4558

4659
## Configuration example
@@ -83,7 +96,7 @@ The following is an example of a VPC Service for a service using custom HTTP and
8396
"hostname": "example.com",
8497
"resolver_network": {
8598
"tunnel_id": "0191dce4-9ab4-7fce-b660-8e5dec5172da",
86-
"resolver_ips": ["10.0.0.1"]
99+
"resolver_ips": ["10.0.0.1"] // Optional
87100
}
88101
}
89102
}
@@ -100,29 +113,29 @@ main = "src/index.js"
100113

101114
[[vpc_services]]
102115
binding = "PRIVATE_API"
103-
service_id = "5634563546"
104-
remote = true
116+
service_id = "e6a0817c-79c5-40ca-9776-a1c019defe70"
117+
remote = true # When true, utilizes [remote bindings](/workers/development-testing/#remote-bindings) to allow access to the VPC Service during local development.
105118

106119
```
107120
</WranglerConfig>
108121

109-
You can have multiple service bindings:
122+
You can have multiple VPC service bindings:
110123

111124
<WranglerConfig>
112125
```toml
113126
[[vpc_services]]
114127
binding = "PRIVATE_API"
115-
service_id = "5634563546"
128+
service_id = "daf43e8c-a81a-4242-9912-4a2ebe4fdd79"
116129
remote = true
117130

118131
[[vpc_services]]
119132
binding = "PRIVATE_DATABASE"
120-
service_id = "7856789012"
133+
service_id = "453b6067-1327-420d-89b3-2b6ad16e6551"
121134
remote = true
122135

123136
[[vpc_services]]
124137
binding = "INTERNAL_CACHE"
125-
service_id = "3412345678"
138+
service_id = "6c39b574-237e-49f4-852a-cea5a93ed8f9"
126139
remote = true
127140

128141
```

‎src/content/docs/workers-vpc/examples/private-api.mdx‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ compatibility_date = "2024-01-01"
6565
[[vpc_services]]
6666
binding = "INTERNAL_API"
6767
service_id = "<YOUR_SERVICE_ID>"
68+
remote = true
6869

6970
```
7071
</WranglerConfig>

‎src/content/docs/workers-vpc/get-started.mdx‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ Before you begin, ensure you have completed the following:
3737
Additionally, you will need:
3838

3939
- Access to a private network (your local network, AWS VPC, Azure VNet, GCP VPC, or on-premise networks)
40+
- The **Connectivity Directory Bind** role to bind to existing VPC Services from Workers.
41+
- Or, the **Connectivity Directory Admin** role to create VPC Services, and bind to them from Workers.
4042

4143
## 1. Create a new Worker project
4244

0 commit comments

Comments
 (0)