In diesem Dokument wird die Verwendung von Private Service Connect (PSC) zum Konfigurieren des Routings von Clients zu Apigee beschrieben, auch als "Northbound-Traffic" bezeichnet.
Übersicht
Sie können PSC verwenden, um die Apigee-VPC mit der VPC zu verbinden, die Sie mit Apigee verbunden haben, oder mit einer anderen von Ihnen verwalteten VPC. Dank dieses Architekturmusters ist es nicht mehr erforderlich, verwaltete Instanzgruppen (Managed Instance Groups, MIGs) zu erstellen, um Anfragen vom globalen Load-Balancer an Apigee weiterzuleiten. Mit der PSC-Routingmethode durchlaufen API-Proxyanfragen einen globalen externen HTTP(S)-Load-Balancer, den Sie in einer VPC an einem einzelnen Punkt des Anhangs in der Apigee-VPC namens Service Attachment installieren.
Mit dieser Konfiguration können Sie Apigee API-Proxy-Anfragen von jeder netzwerkfähigen Maschine aus senden. Siehe Abbildung 1.
Beachten Sie die folgenden unterstützten Northbound-PSC-Features:
Sie können PSC mit jeder vorhandenen Apigee-Instanz verwenden.
Sie können für den Backend-Dienst eine Traffic-Richtlinie für Ausreißererkennung festlegen, um Failover-Szenarien automatisch zu verarbeiten. Weitere Informationen finden Sie hier:
Die Verwendung von PSC mit Apigee unterliegt derzeit den folgenden Einschränkungen:
Nutzerakzeptanzliste für eine Apigee-Instanz aktualisieren
Am 10. Oktober 2024 wurde die zulässige Anzahl von PSC-NEG-Verbindungen pro Projekt zu einer Apigee-Instanz von 20 auf 100 erhöht. Bei allen Apigee-Instanzen, die vor diesem Datum erstellt wurden, müssen Sie die Schritte in diesem Abschnitt ausführen, um die Liste der akzeptierten Nutzer zu aktualisieren und das neue Limit zu nutzen. Sie müssen jede Apigee-Instanz nur einmal aktualisieren, um das neue Verbindungslimit zu erhalten. Weitere Informationen finden Sie unter Einschränkungen von Private Service Connect (PSC).
Wenn Sie insgesamt mehr als 1.000 PSC-NEG-Verbindungen für alle Cloud-Projekte benötigen, die mit einer Apigee-Instanz verbunden sind, wenden Sie sich an den Google Cloud-Support.
So aktualisieren Sie die Liste der Nutzer, die eine Apigee-Instanz akzeptieren, um das höhere Verbindungslimit zu nutzen:
Erstellen Sie eine JSON-Datei mit dem Namen update_consumer_accept_list.json, die die aktuelle Liste der akzeptierten Projekte enthält, die vom vorherigen Befehl zurückgegeben wurden. Beispiel:
Wir unterstützen die Verwendung von PSC für das Northbound-Routing von sowohl internen als auch externen Clients. Eine ausführliche Anleitung finden Sie unter Schritt 8: Routing konfigurieren der Anleitung zur Bereitstellung der Befehlszeile.
Multiregionale Erweiterung mit PSC
Sie können eine Apigee-Organisation auf mehrere Regionen erweitern und PSC für das Northbound-Routing in den neuen Regionen verwenden. Weitere Informationen finden Sie unter Apigee auf mehrere Regionen erweitern.
Apigee-Instanz löschen
So löschen Sie eine Apigee-Instanz, die PSC verwendet:
[[["Leicht verständlich","easyToUnderstand","thumb-up"],["Mein Problem wurde gelöst","solvedMyProblem","thumb-up"],["Sonstiges","otherUp","thumb-up"]],[["Schwer verständlich","hardToUnderstand","thumb-down"],["Informationen oder Beispielcode falsch","incorrectInformationOrSampleCode","thumb-down"],["Benötigte Informationen/Beispiele nicht gefunden","missingTheInformationSamplesINeed","thumb-down"],["Problem mit der Übersetzung","translationIssue","thumb-down"],["Sonstiges","otherDown","thumb-down"]],["Zuletzt aktualisiert: 2025-09-04 (UTC)."],[[["\u003cp\u003eThis page provides information on using Private Service Connect (PSC) for northbound traffic routing to Apigee, specifically excluding Apigee hybrid.\u003c/p\u003e\n"],["\u003cp\u003ePSC allows connecting the Apigee VPC with peered or controlled VPCs, eliminating the need for managed instance groups (MIGs) and instead using a global external HTTP(S) load balancer.\u003c/p\u003e\n"],["\u003cp\u003ePSC supports features like VPC Service Controls, outlier detection for failover, and can be used with any existing Apigee instance, as well as migrating from a MIG-based setup.\u003c/p\u003e\n"],["\u003cp\u003eThere are restrictions when using PSC with Apigee, including limitations on supported load balancer types, the number of project connections, and requirements for deleting existing NEGs upon removing a project.\u003c/p\u003e\n"],["\u003cp\u003eThe limit on PSC network endpoint group (NEG) connections per project has been raised to 100, requiring updates to the consumer accept list for instances created before October 10, 2024 to take advantage of the new limit.\u003c/p\u003e\n"]]],[],null,["# Northbound networking with Private Service Connect\n\n*This page\napplies to **Apigee** , but not to **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n\nThis document describes the use of [Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect) (PSC)\nto configure routing from clients to Apigee, also called \"northbound\" traffic.\n| **Pricing information:** For information on how PSC is metered and billed, see [Private Service Connect](https://cloud.google.com/vpc/pricing#psc-forwarding-rules) on the Virtual Private Cloud pricing page.\n\nOverview\n--------\n\n\nYou can use PSC to connect the Apigee VPC with the VPC that you\nhave peered with Apigee, or with any other VPC that you control. This architectural pattern\neliminates the need to create managed instance groups (MIGs) to forward requests from the global\nload balancer to Apigee. With the PSC routing method, API proxy requests pass through\na [global external HTTP(S) load balancer](https://cloud.google.com/load-balancing/docs/https) that you install in a VPC to a single\npoint of attachment in the Apigee VPC, called a [Service Attachment](https://cloud.google.com/vpc/docs/private-service-connect#service-attachments).\nThis configuration lets you send\nApigee API proxy requests from any\nnetwork-enabled machine. See Figure 1.\n\n\nNote the following supported northbound PSC features:\n\n- You can use PSC with any existing Apigee instance.\n- You can attach multiple PSC network endpoint groups (NEGs) to the Envoy-based, Google Cloud [global external HTTP(S) load balancer](/load-balancing/docs/https).\n- PSC is supported with [VPC Service Controls](/apigee/docs/api-platform/security/vpc-sc).\n- You can set an outlier detection traffic policy on the backend service for handling\n failover scenarios automatically. See the following for more information:\n\n - [Traffic policies](/load-balancing/docs/https/traffic-management-global#traffic_policies)\n - [Configure outlier detection](https://cloud.google.com/load-balancing/docs/https/setting-up-global-traffic-mgmt#configure_outlier_detection)\n - [REST\n Resource: backendServices](/compute/docs/reference/rest/v1/backendServices)\n\n| **Note:** If you currently use the MIG-based approach, you can migrate your system to PSC-based northbound routing. See [Migrate northbound routing from to PSC](/apigee/docs/api-platform/system-administration/migrate-from-mig-to-psc).\n\n**Figure 1: Private service connections**\n\nRestrictions\n------------\n\n\nThe use of PSC with Apigee currently has the following restrictions:\n| **Restrictions:** Note the following restrictions for PSC configuration:\n|\n| - [Global\n| external HTTP(S) load balancer (classic)](/load-balancing/docs/https) is not supported for this configuration.\n| - For failover with multiple PSC NEGs, active health checks are not supported. Use [outlier detection](/load-balancing/docs/https/traffic-management-global#traffic_policies) instead.\n| - Limits apply to the number of Google Cloud projects that can connect to an Apigee instance through PSC, and to the number of PSC NEG connections that you can have per project. For details, see [Private Service Connect (PSC) Limits](/apigee/docs/api-platform/reference/limits#private-service-connect-psc).\n| - If a Google cloud project is removed from `consumerAcceptList`, the existing PSC NEGs in that removed project will continue to work. However, any new NEGs will be rejected. You must delete existing NEGs if you remove their associated projects from the `consumerAcceptList`. Alternatively, you can recreate the Apigee instance, which recreates the service attachment in the Apigee project.\n\nUpdating the consumer accept list for an Apigee instance\n--------------------------------------------------------\n\nOn October 10, 2024, the limit on PSC NEG connections allowed per project to an Apigee instance was raised from\n20 to 100. For any Apigee instances created before that date, you must perform the steps in\nthis section to update the consumer accept list to take advantage of the new limit. You only need to upgrade each\nApigee instance once to receive the new connection limit. See also\n[Private Service Connect (PSC) Limits](/apigee/docs/api-platform/reference/limits#private-service-connect-psc).\n\nIf you need to have more than 1000 PSC NEG connections in total across all of the\nCloud projects connected to an Apigee instance, contact [Google Cloud Support](/apigee/docs/support/getting-started-with-support).\n\nTo update the consumer accept list of an Apigee instance\nto take advantage of the higher connection limit, do the following steps: \n\n### Cloud console\n\nFor detailed steps, see [Edit the accepted projects list](/apigee/docs/api-platform/system-administration/instances#accepted-projects).\n\n### Apigee API\n\nEdit the existing consumer accept list for your Apigee\ninstance. To use the [instances\nAPI](/apigee/docs/reference/apis/apigee/rest/v1/organizations.instances):\n\n1. Get the authentication token for the Apigee API: \n\n ```\n TOKEN=\"$(gcloud auth print-access-token)\"\n ```\n2. Get the list of Cloud projects in an instance's consumer accept list: \n\n ```\n curl https://apigee.googleapis.com/v1/organizations/PROJECT_ID/instances/INSTANCE_ID \\\n -H \"Authorization: Bearer $TOKEN\" -H Content-Type:application/json | jq .consumerAcceptList\n ```\n3. Create a JSON file named `update_consumer_accept_list.json` that contains the current list of accepted projects returned by the previous command. For example: \n\n ```\n {\n \"consumerAcceptList\": [\n \"dg-runtime-test1\",\n \"ne24b79b92c7db623p-tp\",\n \"dg-runtime-test2\",\n \"jd2fee78402218863p-tp\"\n ]\n }\n ```\n4. Optionally, edit the file to add more projects.\n5. Update the instance, using the JSON file you created as input. For example: \n\n ```\n curl https://apigee.googleapis.com/v1/organizations/PROJECT_ID/instances/INSTANCE_ID?updateMask=\"consumer_accept_list\" \\\n -X PATCH -H \"Authorization: Bearer $TOKEN\" -H Content-Type:application/json -d @update_consumer_accept_list.json\n ```\n\nConfigure PSC routing\n---------------------\n\n\nWe support using PSC for northbound routing from both internal and external clients. For detailed steps,\nsee [Step 8: Configure routing](/apigee/docs/api-platform/get-started/install-cli#configure-routing) of\nthe CLI provisioning instructions.\n\nMulti-region expansion with PSC\n-------------------------------\n\nYou can expand an Apigee organization across multiple regions and use PSC for northbound routing in the new regions. For details, see [Expanding Apigee to multiple regions](/apigee/docs/api-platform/system-administration/multi-region).\n\nDeleting an Apigee instance\n---------------------------\n\n\nTo delete an Apigee instance that uses PSC, follow these steps:\n\n1. [Remove and delete the PSC NEG backend](https://cloud.google.com/load-balancing/docs/cleaning-up-lb-setup#deleting_the_negs) from the external load balancer.\n2. Delete the Apigee runtime instance using the [Apigee API](/apigee/docs/reference/apis/apigee/rest/v1/organizations.instances/delete). This is a long-running operation that can take up to 20 minutes to complete.\n3. Optionally retrieve the long-running operation state using the [Apigee API](/apigee/docs/reference/apis/apigee/rest/v1/organizations.operations/get)."]]
