Questo documento descrive l'utilizzo di Private Service Connect (PSC)
per configurare il routing dai client ad Apigee, chiamato anche traffico "inbound".
Panoramica
Puoi utilizzare PSC per connettere il VPC Apigee al VPC di cui hai eseguito il peering con Apigee o a qualsiasi altro VPC che controlli. Questo pattern architetturale
elimina la necessità di creare gruppi di istanze gestite per inoltrare le richieste dal bilanciatore del carico globale ad Apigee. Con il metodo di routing PSC, le richieste proxy API passano attraverso
un bilanciatore del carico HTTP(S) esterno globale che installi in un VPC a un singolo
punto di collegamento nel VPC Apigee, chiamato collegamento del servizio.
Questa configurazione ti consente di inviare
richieste proxy API Apigee da qualsiasi
macchina abilitata alla rete. Vedi la Figura 1.
Tieni presente le seguenti funzionalità PSC supportate in direzione nord:
Puoi utilizzare PSC con qualsiasi istanza Apigee esistente.
Puoi impostare una policy di gestione del traffico per il rilevamento di outlier nel servizio di backend per gestire
automaticamente gli scenari di failover. Vai ai seguenti argomenti per ulteriori informazioni:
L'utilizzo di PSC con Apigee presenta attualmente le seguenti limitazioni:
Aggiornamento dell'elenco di accettazione dei consumatori per un'istanza Apigee
Il 10 ottobre 2024, il limite di connessioni NEG PSC consentite per progetto a un'istanza Apigee è stato aumentato da
20 a 100. Per tutte le istanze Apigee create prima di questa data, devi eseguire i passaggi descritti in
questa sezione per aggiornare l'elenco di accettazione dei consumer e sfruttare il nuovo limite. Devi eseguire l'upgrade di ogni istanza di Apigee una sola volta per ricevere il nuovo limite di connessioni. Vedi anche
Limiti di Private Service Connect (PSC).
Se hai bisogno di più di 1000 connessioni NEG PSC in totale in tutti i progetti Cloud collegati a un'istanza Apigee, contatta l'assistenza Google Cloud.
Per aggiornare l'elenco di accettazione dei consumer di un'istanza Apigee
per sfruttare il limite di connessione più elevato, segui questi passaggi:
Crea un file JSON denominato update_consumer_accept_list.json contenente l'elenco attuale dei progetti accettati restituito dal
comando precedente. Ad esempio:
Supportiamo l'utilizzo di PSC per il routing in uscita da client interni ed esterni. Per la procedura dettagliata,
vedi Passaggio 8: configura il routing delle
istruzioni di provisioning della CLI.
Espansione multiregionale con PSC
Puoi espandere un'organizzazione Apigee in più regioni e utilizzare PSC per il routing in direzione nord
nelle nuove regioni. Per maggiori dettagli, vedi
Espansione di Apigee in più regioni.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[[["\u003cp\u003eThis page provides information on using Private Service Connect (PSC) for northbound traffic routing to Apigee, specifically excluding Apigee hybrid.\u003c/p\u003e\n"],["\u003cp\u003ePSC allows connecting the Apigee VPC with peered or controlled VPCs, eliminating the need for managed instance groups (MIGs) and instead using a global external HTTP(S) load balancer.\u003c/p\u003e\n"],["\u003cp\u003ePSC supports features like VPC Service Controls, outlier detection for failover, and can be used with any existing Apigee instance, as well as migrating from a MIG-based setup.\u003c/p\u003e\n"],["\u003cp\u003eThere are restrictions when using PSC with Apigee, including limitations on supported load balancer types, the number of project connections, and requirements for deleting existing NEGs upon removing a project.\u003c/p\u003e\n"],["\u003cp\u003eThe limit on PSC network endpoint group (NEG) connections per project has been raised to 100, requiring updates to the consumer accept list for instances created before October 10, 2024 to take advantage of the new limit.\u003c/p\u003e\n"]]],[],null,["# Northbound networking with Private Service Connect\n\n*This page\napplies to **Apigee** , but not to **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n\nThis document describes the use of [Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect) (PSC)\nto configure routing from clients to Apigee, also called \"northbound\" traffic.\n| **Pricing information:** For information on how PSC is metered and billed, see [Private Service Connect](https://cloud.google.com/vpc/pricing#psc-forwarding-rules) on the Virtual Private Cloud pricing page.\n\nOverview\n--------\n\n\nYou can use PSC to connect the Apigee VPC with the VPC that you\nhave peered with Apigee, or with any other VPC that you control. This architectural pattern\neliminates the need to create managed instance groups (MIGs) to forward requests from the global\nload balancer to Apigee. With the PSC routing method, API proxy requests pass through\na [global external HTTP(S) load balancer](https://cloud.google.com/load-balancing/docs/https) that you install in a VPC to a single\npoint of attachment in the Apigee VPC, called a [Service Attachment](https://cloud.google.com/vpc/docs/private-service-connect#service-attachments).\nThis configuration lets you send\nApigee API proxy requests from any\nnetwork-enabled machine. See Figure 1.\n\n\nNote the following supported northbound PSC features:\n\n- You can use PSC with any existing Apigee instance.\n- You can attach multiple PSC network endpoint groups (NEGs) to the Envoy-based, Google Cloud [global external HTTP(S) load balancer](/load-balancing/docs/https).\n- PSC is supported with [VPC Service Controls](/apigee/docs/api-platform/security/vpc-sc).\n- You can set an outlier detection traffic policy on the backend service for handling\n failover scenarios automatically. See the following for more information:\n\n - [Traffic policies](/load-balancing/docs/https/traffic-management-global#traffic_policies)\n - [Configure outlier detection](https://cloud.google.com/load-balancing/docs/https/setting-up-global-traffic-mgmt#configure_outlier_detection)\n - [REST\n Resource: backendServices](/compute/docs/reference/rest/v1/backendServices)\n\n| **Note:** If you currently use the MIG-based approach, you can migrate your system to PSC-based northbound routing. See [Migrate northbound routing from to PSC](/apigee/docs/api-platform/system-administration/migrate-from-mig-to-psc).\n\n**Figure 1: Private service connections**\n\nRestrictions\n------------\n\n\nThe use of PSC with Apigee currently has the following restrictions:\n| **Restrictions:** Note the following restrictions for PSC configuration:\n|\n| - [Global\n| external HTTP(S) load balancer (classic)](/load-balancing/docs/https) is not supported for this configuration.\n| - For failover with multiple PSC NEGs, active health checks are not supported. Use [outlier detection](/load-balancing/docs/https/traffic-management-global#traffic_policies) instead.\n| - Limits apply to the number of Google Cloud projects that can connect to an Apigee instance through PSC, and to the number of PSC NEG connections that you can have per project. For details, see [Private Service Connect (PSC) Limits](/apigee/docs/api-platform/reference/limits#private-service-connect-psc).\n| - If a Google cloud project is removed from `consumerAcceptList`, the existing PSC NEGs in that removed project will continue to work. However, any new NEGs will be rejected. You must delete existing NEGs if you remove their associated projects from the `consumerAcceptList`. Alternatively, you can recreate the Apigee instance, which recreates the service attachment in the Apigee project.\n\nUpdating the consumer accept list for an Apigee instance\n--------------------------------------------------------\n\nOn October 10, 2024, the limit on PSC NEG connections allowed per project to an Apigee instance was raised from\n20 to 100. For any Apigee instances created before that date, you must perform the steps in\nthis section to update the consumer accept list to take advantage of the new limit. You only need to upgrade each\nApigee instance once to receive the new connection limit. See also\n[Private Service Connect (PSC) Limits](/apigee/docs/api-platform/reference/limits#private-service-connect-psc).\n\nIf you need to have more than 1000 PSC NEG connections in total across all of the\nCloud projects connected to an Apigee instance, contact [Google Cloud Support](/apigee/docs/support/getting-started-with-support).\n\nTo update the consumer accept list of an Apigee instance\nto take advantage of the higher connection limit, do the following steps: \n\n### Cloud console\n\nFor detailed steps, see [Edit the accepted projects list](/apigee/docs/api-platform/system-administration/instances#accepted-projects).\n\n### Apigee API\n\nEdit the existing consumer accept list for your Apigee\ninstance. To use the [instances\nAPI](/apigee/docs/reference/apis/apigee/rest/v1/organizations.instances):\n\n1. Get the authentication token for the Apigee API: \n\n ```\n TOKEN=\"$(gcloud auth print-access-token)\"\n ```\n2. Get the list of Cloud projects in an instance's consumer accept list: \n\n ```\n curl https://apigee.googleapis.com/v1/organizations/PROJECT_ID/instances/INSTANCE_ID \\\n -H \"Authorization: Bearer $TOKEN\" -H Content-Type:application/json | jq .consumerAcceptList\n ```\n3. Create a JSON file named `update_consumer_accept_list.json` that contains the current list of accepted projects returned by the previous command. For example: \n\n ```\n {\n \"consumerAcceptList\": [\n \"dg-runtime-test1\",\n \"ne24b79b92c7db623p-tp\",\n \"dg-runtime-test2\",\n \"jd2fee78402218863p-tp\"\n ]\n }\n ```\n4. Optionally, edit the file to add more projects.\n5. Update the instance, using the JSON file you created as input. For example: \n\n ```\n curl https://apigee.googleapis.com/v1/organizations/PROJECT_ID/instances/INSTANCE_ID?updateMask=\"consumer_accept_list\" \\\n -X PATCH -H \"Authorization: Bearer $TOKEN\" -H Content-Type:application/json -d @update_consumer_accept_list.json\n ```\n\nConfigure PSC routing\n---------------------\n\n\nWe support using PSC for northbound routing from both internal and external clients. For detailed steps,\nsee [Step 8: Configure routing](/apigee/docs/api-platform/get-started/install-cli#configure-routing) of\nthe CLI provisioning instructions.\n\nMulti-region expansion with PSC\n-------------------------------\n\nYou can expand an Apigee organization across multiple regions and use PSC for northbound routing in the new regions. For details, see [Expanding Apigee to multiple regions](/apigee/docs/api-platform/system-administration/multi-region).\n\nDeleting an Apigee instance\n---------------------------\n\n\nTo delete an Apigee instance that uses PSC, follow these steps:\n\n1. [Remove and delete the PSC NEG backend](https://cloud.google.com/load-balancing/docs/cleaning-up-lb-setup#deleting_the_negs) from the external load balancer.\n2. Delete the Apigee runtime instance using the [Apigee API](/apigee/docs/reference/apis/apigee/rest/v1/organizations.instances/delete). This is a long-running operation that can take up to 20 minutes to complete.\n3. Optionally retrieve the long-running operation state using the [Apigee API](/apigee/docs/reference/apis/apigee/rest/v1/organizations.operations/get)."]]
