Loading post…
DatabricksAlex Esibov, Manish Bansal, Stanley Wang, Justin Ly, Vijay RajaAnnouncement
Introducing Private Network Gateway
Summary
Databricks announced Private Network Gateway (PNG) in public preview on Azure and private preview on AWS, addressing the networking friction that prevented teams from moving workloads to serverless compute. PNG provides a single managed gateway from serverless compute into a customer’s virtual network, eliminating the need for per-resource private endpoints, load balancers, and proxy VMs. Customers configure the gateway via a Network Connectivity Configuration (NCC) and delegate one subnet, with Databricks managing the gateway infrastructure while customers retain control over routing and security. PNG supports use cases such as ingesting from private databases via Lakeflow Connect, connecting AI agents to private MCP servers, using private package repositories, and routing egress through customer firewalls. The gateway offers two traffic modes for precise control or broad egress inspection and works alongside existing private connectivity without disruption.
Context
Serverless compute runs in a Databricks-managed network, making it difficult to reach private resources such as databases, Kafka clusters, and internal APIs. Previously, each resource required separate private endpoints, load balancers, and proxy VMs, demanding coordination across networking, security, and admin teams. Over 75% of customers cited network configuration complexity as the main reason workloads stayed on classic compute. PNG simplifies this by providing a single gateway into the customer’s network.
Approach / What changed
PNG creates a managed, encrypted gateway from Databricks serverless compute into a customer-delegated subnet within their virtual network. Customers configure the gateway via a Network Connectivity Configuration (NCC) and attach it to workspaces. Two traffic modes are available: specific_destinations (only listed FQDNs) and all_traffic (all outbound except Private Link/service-endpoint paths). Databricks manages the gateway infrastructure; customers retain control over routing, security groups, and DNS.
Takeaways
PNG eliminates the need for per-resource private endpoints, load balancers, and proxy VMs by providing a single managed gateway into the customer’s virtual network.
The gateway offers two traffic modes: specific_destinations (only listed FQDNs) and all_traffic (all outbound except Private Link/service-endpoint paths), allowing precise control or broad egress inspection.
PNG is additive and works alongside existing private connectivity (Private Link, service endpoints) without changing them, and customers retain control over routing, security groups, and DNS.
FAQ
How does PNG differ from Serverless Private Link?
Serverless Private Link is designed for cloud-managed services like AWS S3 or Azure Data Lake Storage. Private Network Gateway is for customer-hosted resources such as databases, Kafka clusters, or internal APIs, providing a single gateway into the customer's network instead of per-resource endpoints.
What traffic modes does PNG support?
PNG supports two modes: specific_destinations sends only the fully qualified domain names you list through the gateway, and all_traffic routes all outbound traffic through your network except for more-specific Private Link or service-endpoint paths, which keep their native route.
Do I need to deploy or manage gateway VMs?
No, Databricks creates and runs the gateway for you. You only need to delegate one subnet in your virtual network; Databricks manages the gateway infrastructure, so there are no gateway VMs for you to deploy, patch, or scale.
Source and freshness
- Source
- databricks.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.