Databricks Community

Hariharan_0510 · Tuesday

1.Not able to access interent (gcp databricks) 2.both ingress and egress access given in default policy
2.How to overcome this issue and i am using serverless
3.in free databricks able to use interent in gcp based databricks it is creating issue

import requests

print(requests.get("https://142.250.190.78", timeout=10).status_code)

balajij8 · Wednesday

@Hariharan_0510 A free workspace typically defaults to full egress access without any underlying VPC level restrictions. You can check the egress mode of the default network policy in the current setup. Go to Account Console and navigate to Security - Networking - Policies. You can ask the account admin to verify if its set to Allow access to all destinations and enable if it not done already. It must be an enterprise tier workspace. More details here

If the policy is set correctly to allow all traffic, the issue is likely at the GCP level rather than within Databricks. You can check the GCP VPC firewall rules or verify if VPC Service Controls are active in the environment. These controls are applied outside of the Databricks network policy and likely block outbound serverless traffic even if Databricks itself is configured to allow it.

Louis_Frolio · Wednesday

Hello @Hariharan_0510 , I took a look at both internal and external documentation and here is what I found.

Building on @balajij8's reply, the serverless egress policy is the right place to start, but two things before you go hunting further.

First, the test itself. requests.get("https://142.250.190.78") is an HTTPS call to a bare IP. Google's certificate won't match that IP, so requests will throw a certificate error even when outbound connectivity is fine. Please rerun against a hostname and share the full exception:

import requests
r = requests.get("https://www.google.com", timeout=10)
print(r.status_code, r.url)

Don't reach for verify=False as the fix; that only turns off certificate checking and hides the answer.

Second, if the hostname test still fails, have your account admin confirm which network policy is actually assigned to this workspace (Account Console > Security > Networking > Policies, as balajij8 described). Ingress and egress are separate controls inside that policy, so "both given" needs a closer look. Check the egress mode: Full Access allows outbound internet; Restricted Access denies by default and only allows destinations listed by FQDN or Cloud Storage bucket. Also check whether the policy is in dry-run or enforced mode, and restart the serverless workload after any change. Note that serverless egress control requires the Enterprise tier.

On balajij8's point about GCP VPC firewall rules and VPC Service Controls: serverless compute runs in a Databricks-managed network, not your VPC, so those only come into play if your workspace routes serverless traffic through customer-controlled private connectivity. They're a later check, not the first one. And Free Edition isn't a like-for-like comparison with a provisioned GCP workspace, so working there doesn't tell us much about this one.

References: