Skip to content

Commit 5a1db63

Browse files
thomasgauvinOxyjunpedrosousaxortive
authored
Thomasgauvin housekeeping (#25308)
* Step 1 * Setting up overview and getting started chapters * Setting up folders * Setting up folders 2 * Fixing error * nit * folder capitalisation fix part 1 * Folder capitalisation fix part 2 * workers vpc docs pass 2 * update changelog entry * more cloudflared edits * PCX Review * address pr comments * clean up examples * more cleanup * fix dead links * fix binding references to vpc_services * minor nits * adjust examples to include s3 example, more context across examples * fix urls due to changes in cloudflare-one docs structure * fixing too many back ticks * Update src/content/changelog/workers-vpc/2025-09-25-workers-vpc.mdx Co-authored-by: Pedro Sousa <[email protected]> * Update src/content/changelog/workers-vpc/2025-09-25-workers-vpc.mdx * Update src/content/changelog/workers-vpc/2025-09-25-workers-vpc.mdx Co-authored-by: Matt <[email protected]> * Update src/content/docs/workers-vpc/api/index.mdx Co-authored-by: Matt <[email protected]> * Update src/content/docs/workers-vpc/api/index.mdx Co-authored-by: Matt <[email protected]> * Update src/content/docs/workers-vpc/api/index.mdx Co-authored-by: Matt <[email protected]> * Update src/content/docs/workers-vpc/configuration/vpc-services.mdx * Update src/content/docs/workers-vpc/api/index.mdx Co-authored-by: Matt <[email protected]> --------- Co-authored-by: Jun Lee <[email protected]> Co-authored-by: Pedro Sousa <[email protected]> Co-authored-by: Matt <[email protected]>
1 parent feec1a6 commit 5a1db63

File tree

18 files changed

+1169
-0
lines changed

18 files changed

+1169
-0
lines changed

‎src/content/changelog/workers-vpc/2025-09-25-workers-vpc.mdx‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
title: Workers VPC Services (Beta)
3+
description: Access private resources in your VPC from Cloudflare Workers
4+
date: 2025-11-05
5+
---
6+
7+
We're excited to announce the beta release of **Workers VPC Services**, enabling Cloudflare Workers to securely access resources in your private networks.
8+
9+
## What's new
10+
11+
- **VPC Services**: Create secure connections to internal APIs, databases, and services through Cloudflare Tunnel using familiar Worker binding syntax
12+
- **Multi-cloud Support**: Connect to resources across AWS, Azure, GCP, and on-premise infrastructure
13+
14+
## Getting started
15+
16+
Set up a Cloudflare Tunnel, create a VPC Service, add service bindings to your Worker, and access private resources securely. [Refer to the documentation](/workers-vpc/) to get started.

‎src/content/docs/workers-vpc/api/index.mdx‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
---
2+
title: Workers Binding API
3+
pcx_content_type: reference
4+
sidebar:
5+
order: 4
6+
---
7+
8+
import { Tabs, TabItem, Render } from "~/components";
9+
10+
VPC Service bindings provide a convenient API for accessing VPC Services from your Worker. Each binding represents a connection to a service in your private network through a Cloudflare Tunnel.
11+
12+
Each request made on the binding will route to the specific service that was configured for the VPC Service, while restricting access to the rest of your private network.
13+
14+
:::note
15+
16+
Workers VPC is currently in beta. Features and APIs may change before general availability. While in beta, Workers VPC is available for free to all Workers plans.
17+
18+
:::
19+
20+
## VPC Service binding
21+
22+
A VPC Service binding is accessed via the `env` parameter in your Worker's fetch handler. It provides a `fetch()` method for making HTTP requests to your private service.
23+
24+
## fetch()
25+
26+
Makes an HTTP request to the private service through the configured tunnel.
27+
28+
```js
29+
const response = await env.VPC_SERVICE_BINDING.fetch(resource, options);
30+
```
31+
32+
:::note
33+
The [VPC Service configurations](/workers-vpc/configuration/vpc-services/#vpc-service-configuration) will always be used to connect and route requests to your services in external networks, even if a different URL or host is present in the actual `fetch()` operation of the Worker code.
34+
35+
The host provided in the `fetch()` operation is not used to route requests, and instead only populates the `Host` field for a HTTP request that can be parsed by the server and used for Server Name Indication (SNI), when the `https` scheme is specified.
36+
37+
The port provided in the `fetch()` operation is ignored — the port specified in the VPC Service configuration will be used.
38+
:::
39+
40+
### Parameters
41+
42+
- `resource` (string | URL | Request) - The URL to fetch. This must be an absolute URL including protocol, host, and path (for example, `http://internal-api/api/users`)
43+
- `options` (optional RequestInit) - Standard fetch options including:
44+
- `method` - HTTP method (GET, POST, PUT, DELETE, etc.)
45+
- `headers` - Request headers
46+
- `body` - Request body
47+
- `signal` - AbortSignal for request cancellation
48+
49+
:::note[Absolute URLs Required]
50+
VPC Service fetch requests must use absolute URLs including the protocol (`http`/`https`), host, and path. Relative paths are not supported.
51+
:::
52+
53+
### Return value
54+
55+
Returns a `Promise<Response>` that resolves to a [standard Fetch API Response object](https://developer.mozilla.org/en-US/docs/Web/API/Response).
56+
57+
### Examples
58+
59+
#### Basic GET request
60+
61+
```js
62+
export default {
63+
async fetch(request, env) {
64+
const privateRequest = new Request(
65+
"http://internal-api.company.local/users",
66+
);
67+
const response = await env.VPC_SERVICE_BINDING.fetch(privateRequest);
68+
const users = await response.json();
69+
70+
return new Response(JSON.stringify(users), {
71+
headers: { "Content-Type": "application/json" },
72+
});
73+
},
74+
};
75+
```
76+
77+
#### POST request with body
78+
79+
```js
80+
export default {
81+
async fetch(request, env) {
82+
const privateRequest = new Request(
83+
"http://internal-api.company.local/users",
84+
{
85+
method: "POST",
86+
headers: {
87+
"Content-Type": "application/json",
88+
Authorization: `Bearer ${env.API_TOKEN}`,
89+
},
90+
body: JSON.stringify({
91+
name: "John Doe",
92+
email: "[email protected]",
93+
}),
94+
},
95+
);
96+
97+
const response = await env.VPC_SERVICE_BINDING.fetch(privateRequest);
98+
99+
if (!response.ok) {
100+
return new Response("Failed to create user", { status: response.status });
101+
}
102+
103+
const user = await response.json();
104+
return new Response(JSON.stringify(user), {
105+
headers: { "Content-Type": "application/json" },
106+
});
107+
},
108+
};
109+
```
110+
111+
#### Request with HTTPS and IP address
112+
113+
```js
114+
export default {
115+
async fetch(request, env) {
116+
const privateRequest = new Request("https://10.0.1.50/api/data");
117+
const response = await env.VPC_SERVICE_BINDING.fetch(privateRequest);
118+
119+
return response;
120+
},
121+
};
122+
```
123+
124+
## Next steps
125+
126+
- Configure [service bindings in wrangler.toml](/workers-vpc/configuration/vpc-services/)
127+
- Refer to [usage examples](/workers-vpc/examples/)

‎src/content/docs/workers-vpc/configuration/index.mdx‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: Configuration
3+
pcx_content_type: navigation
4+
sidebar:
5+
group:
6+
hideIndex: true
7+
order: 3
8+
---
9+
10+
import { DirectoryListing } from "~/components";
11+
12+
<DirectoryListing />

‎src/content/docs/workers-vpc/configuration/tunnel/hardware-requirements.mdx‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
title: Hardware requirements
3+
pcx_content_type: concept
4+
sidebar:
5+
order: 3
6+
---
7+
8+
import { TunnelCalculator } from "~/components";
9+
10+
## Recommendations
11+
12+
For production use cases, we recommend the following baseline configuration:
13+
14+
- Run a cloudflared replica on two dedicated host machines per network location. Using two hosts enables server-side redundancy. See [tunnel availability and replicas](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) for setup instructions.
15+
- Size each host with minimum 4GB of RAM and 4 CPU cores.
16+
17+
This setup is usually sufficient to handle traffic from small-medium sized applications. The actual amount of resources used by cloudflared will depend on many variables, including the number of requests per second, bandwidth, network path, and hardware. If usage increases beyond your existing tunnel capacity, you can scale your tunnel by increasing the hardware allocated to the cloudflared hosts.
18+
19+
## Capacity calculator
20+
21+
To estimate tunnel capacity requirements for your deployment, refer to the [tunnel capacity calculator in the Zero Trust documentation](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/system-requirements/).
22+
23+
## Scaling considerations
24+
25+
Monitor tunnel performance and scale accordingly:
26+
27+
- **CPU utilization**: Keep below 70% average usage
28+
- **Memory usage**: Maintain headroom for traffic spikes
29+
- **Network bandwidth**: Ensure adequate throughput for peak loads
30+
- **Connection count**: Scale cloudflared vertically when approaching capacity limits
31+
32+
## Next steps
33+
34+
- Configure [tunnel deployment](/workers-vpc/configuration/tunnel/)
35+
- Set up [high availability](/workers-vpc/configuration/tunnel/) with multiple replicas

‎src/content/docs/workers-vpc/configuration/tunnel/index.mdx‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
---
2+
title: Cloudflare Tunnel
3+
pcx_content_type: concept
4+
sidebar:
5+
order: 2
6+
---
7+
8+
import { GlossaryTooltip, Tabs, TabItem, Example } from "~/components";
9+
10+
Cloudflare Tunnel creates secure connections from your infrastructure to Cloudflare's global network, providing the network connectivity that allows Workers to access your private resources.
11+
12+
When you create a VPC Service, you specify a tunnel ID and target service. Workers VPC then routes requests from your Worker to the appropriate tunnel, forwards traffic to your private network, connects to the specified hostname or IP address, and returns responses back to your Worker.
13+
14+
The tunnel maintains persistent connections to Cloudflare, eliminating the need for inbound firewall rules or public IP addresses.
15+
16+
:::note
17+
This section provides tunnel configuration specific to Workers VPC use cases. For comprehensive tunnel documentation including monitoring and advanced configurations, refer to the [full Cloudflare Tunnel documentation](/cloudflare-one/networks/connectors/cloudflare-tunnel/).
18+
:::
19+
20+
## Create and run tunnel (`cloudflared`)
21+
22+
Cloudflare Tunnel requires the installation of a lightweight and highly scalable server-side daemon, `cloudflared`, to connect your infrastructure to Cloudflare.
23+
24+
Cloudflare Tunnels can be created one of two ways:
25+
26+
1. **Remotely-managed tunnels (recommended):** Remotely-managed configurations are stored on Cloudflare, allowing you to manage the tunnel from any machine using the dashboard, API, or Terraform.
27+
2. **Locally-managed tunnels:** A locally-managed tunnel is created by running `cloudflared tunnel create <NAME>` on the command line. Tunnel configuration is stored in your local cloudflared directory.
28+
29+
For Workers VPC, we recommend creating a remotely-managed tunnel through the dashboard. Follow the [Tunnels for Workers VPC dashboard setup guide](/workers-vpc/get-started/) to create your tunnel with provided installation commands shown in the dashboard.
30+
31+
For locally-managed tunnels, refer to the [`cloudflared` locally-managed tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/) guide. For manual installation, refer to the [`cloudflared` downloads page](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) for platform-specific installation instructions.
32+
33+
:::note[Important Note]
34+
Cloudflare Tunnels can either be configured for usage with [Cloudflare Zero Trust](/cloudflare-one/) or [Workers VPC](/workers-vpc/).
35+
36+
Use Tunnels with Zero Trust when you are exposing internal applications securely to your employees with Cloudflare Access and hostnames.
37+
38+
Use Tunnels with Workers VPC when you want to access private APIs, private databases, internal services or other HTTP services within your cloud or on-premise private network from Workers.
39+
40+
The same `cloudflared` instance can be used to cover both Zero Trust and Workers VPC use cases simultaneously.
41+
42+
:::
43+
44+
:::note
45+
46+
[Ingress configurations](/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/) for locally-managed tunnels are only relevant when using tunnels to expose services to the public internet, and are not required for Workers VPC as routing is handled by the VPC Service configuration.
47+
48+
:::
49+
50+
## Cloud platform setup guides
51+
52+
For platform-specific tunnel deployment instructions for production workloads:
53+
54+
- [AWS](/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/aws/) - Deploy tunnels in Amazon Web Services
55+
- [Azure](/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/azure/) - Deploy tunnels in Microsoft Azure
56+
- [Google Cloud](/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/google-cloud-platform/) - Deploy tunnels in Google Cloud Platform
57+
- [Kubernetes](/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/kubernetes/) - Deploy tunnels in Kubernetes clusters
58+
- [Terraform](/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/terraform/) - Deploy tunnels using Infrastructure as Code
59+
60+
Refer to the full Cloudflare Tunnel documentation on [how to setup Tunnels for high availability and failover with replicas](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/).
61+
62+
:::note
63+
We do not recommend using `cloudflared` in autoscaling setups because downscaling (removing replicas) will break existing user connections to that replica. Additionally, `cloudflared` does not load balance across replicas; replicas are strictly for high availability and requests are routed to the nearest replica.
64+
:::
65+
66+
## Next steps
67+
68+
- Configure [VPC Services](/workers-vpc/configuration/vpc-services/) to connect your tunnels to Workers
69+
- Review [hardware requirements](/workers-vpc/configuration/tunnel/hardware-requirements/) for capacity planning
70+
- Review the [complete Cloudflare Tunnel documentation](/cloudflare-one/networks/connectors/cloudflare-tunnel/) for advanced features

0 commit comments

Comments
 (0)