I put together a reference covering Cloud Run networking end-to-end — Direct VPC egress subnet sizing, ingress patterns (ILB vs PSC vs run.app), PSA/PGA/PSC routing differences, VPC-SC perimeter configuration, tenant isolation in Shared VPC, and service-to-service auth. Each section is backed by current Google Cloud docs.
A few things that are commonly wrong in diagrams I’ve reviewed:

• Direct VPC egress is outbound-only; it doesn’t give Cloud Run a private inbound IP
• Cloud NAT is source NAT on the egress path, not an inline inspection appliance
• Serverless NEG backends have no health checks — outlier detection is a different mechanism
• PSA gives you network reachability, not database authentication
  Full write-up with packet walks and anti-patterns: