Este documento descreve a utilização do Private Service Connect (PSC) para configurar o encaminhamento de clientes para o Apigee, também denominado tráfego "northbound".
Vista geral
Pode usar o PSC para ligar a VPC do Apigee à VPC que
associou ao Apigee ou a qualquer outra VPC que controle. Este padrão de arquitetura elimina a necessidade de criar grupos de instâncias geridos (MIGs) para encaminhar pedidos do balanceador de carga global para o Apigee. Com o método de encaminhamento do PSC, os pedidos de proxy de API passam por um balanceador de carga de HTTP(S) externo global que instala numa VPC para um único ponto de ligação na VPC do Apigee, denominado anexo de serviço.
Esta configuração permite-lhe enviar pedidos de proxy de API do Apigee a partir de qualquer máquina com ligação à rede. Veja a Figura 1.
Tenha em atenção as seguintes funcionalidades de PSC suportadas a montante:
Pode usar o PSC com qualquer instância do Apigee existente.
Pode definir uma política de tráfego de deteção de valores atípicos no serviço de back-end para processar automaticamente cenários de comutação por falha. Consulte o seguinte para mais informações:
A utilização do PSC com o Apigee tem atualmente as seguintes restrições:
Atualizar a lista de aceitação de consumidores para uma instância do Apigee
A 10 de outubro de 2024, o limite de ligações NEG de PSC permitidas por projeto a uma instância do Apigee foi aumentado de 20 para 100. Para todas as instâncias do Apigee criadas antes dessa data, tem de realizar os passos descritos nesta secção para atualizar a lista de aceitação de consumidores e tirar partido do novo limite. Só tem de atualizar cada instância do Apigee uma vez para receber o novo limite de ligações. Consulte também os limites do Private Service Connect (PSC).
Se precisar de ter mais de 1000 associações de NEG do PSC no total em todos os
projetos do Google Cloud associados a uma instância do Apigee, contacte o apoio técnico do Google Cloud.
Para atualizar a lista de aceitação de consumidores de uma instância do Apigee
para tirar partido do limite de ligações mais elevado, siga estes passos:
Crie um ficheiro JSON denominado update_consumer_accept_list.json que contenha a lista atual de projetos aceites devolvidos pelo comando anterior. Por exemplo:
Suportamos a utilização do PSC para o encaminhamento no sentido norte de clientes internos e externos. Para ver passos detalhados,
consulte o Passo 8: configure o encaminhamento das
instruções de aprovisionamento da CLI.
Expansão multirregional com o PSC
Pode expandir uma organização do Apigee em várias regiões e usar o PSC para o encaminhamento a montante nas novas regiões. Para ver detalhes, consulte o artigo Expansão do Apigee para várias regiões.
Eliminar uma instância do Apigee
Para eliminar uma instância do Apigee que usa o PSC, siga estes passos:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[[["\u003cp\u003eThis page provides information on using Private Service Connect (PSC) for northbound traffic routing to Apigee, specifically excluding Apigee hybrid.\u003c/p\u003e\n"],["\u003cp\u003ePSC allows connecting the Apigee VPC with peered or controlled VPCs, eliminating the need for managed instance groups (MIGs) and instead using a global external HTTP(S) load balancer.\u003c/p\u003e\n"],["\u003cp\u003ePSC supports features like VPC Service Controls, outlier detection for failover, and can be used with any existing Apigee instance, as well as migrating from a MIG-based setup.\u003c/p\u003e\n"],["\u003cp\u003eThere are restrictions when using PSC with Apigee, including limitations on supported load balancer types, the number of project connections, and requirements for deleting existing NEGs upon removing a project.\u003c/p\u003e\n"],["\u003cp\u003eThe limit on PSC network endpoint group (NEG) connections per project has been raised to 100, requiring updates to the consumer accept list for instances created before October 10, 2024 to take advantage of the new limit.\u003c/p\u003e\n"]]],[],null,["# Northbound networking with Private Service Connect\n\n*This page\napplies to **Apigee** , but not to **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n\nThis document describes the use of [Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect) (PSC)\nto configure routing from clients to Apigee, also called \"northbound\" traffic.\n| **Pricing information:** For information on how PSC is metered and billed, see [Private Service Connect](https://cloud.google.com/vpc/pricing#psc-forwarding-rules) on the Virtual Private Cloud pricing page.\n\nOverview\n--------\n\n\nYou can use PSC to connect the Apigee VPC with the VPC that you\nhave peered with Apigee, or with any other VPC that you control. This architectural pattern\neliminates the need to create managed instance groups (MIGs) to forward requests from the global\nload balancer to Apigee. With the PSC routing method, API proxy requests pass through\na [global external HTTP(S) load balancer](https://cloud.google.com/load-balancing/docs/https) that you install in a VPC to a single\npoint of attachment in the Apigee VPC, called a [Service Attachment](https://cloud.google.com/vpc/docs/private-service-connect#service-attachments).\nThis configuration lets you send\nApigee API proxy requests from any\nnetwork-enabled machine. See Figure 1.\n\n\nNote the following supported northbound PSC features:\n\n- You can use PSC with any existing Apigee instance.\n- You can attach multiple PSC network endpoint groups (NEGs) to the Envoy-based, Google Cloud [global external HTTP(S) load balancer](/load-balancing/docs/https).\n- PSC is supported with [VPC Service Controls](/apigee/docs/api-platform/security/vpc-sc).\n- You can set an outlier detection traffic policy on the backend service for handling\n failover scenarios automatically. See the following for more information:\n\n - [Traffic policies](/load-balancing/docs/https/traffic-management-global#traffic_policies)\n - [Configure outlier detection](https://cloud.google.com/load-balancing/docs/https/setting-up-global-traffic-mgmt#configure_outlier_detection)\n - [REST\n Resource: backendServices](/compute/docs/reference/rest/v1/backendServices)\n\n| **Note:** If you currently use the MIG-based approach, you can migrate your system to PSC-based northbound routing. See [Migrate northbound routing from to PSC](/apigee/docs/api-platform/system-administration/migrate-from-mig-to-psc).\n\n**Figure 1: Private service connections**\n\nRestrictions\n------------\n\n\nThe use of PSC with Apigee currently has the following restrictions:\n| **Restrictions:** Note the following restrictions for PSC configuration:\n|\n| - [Global\n| external HTTP(S) load balancer (classic)](/load-balancing/docs/https) is not supported for this configuration.\n| - For failover with multiple PSC NEGs, active health checks are not supported. Use [outlier detection](/load-balancing/docs/https/traffic-management-global#traffic_policies) instead.\n| - Limits apply to the number of Google Cloud projects that can connect to an Apigee instance through PSC, and to the number of PSC NEG connections that you can have per project. For details, see [Private Service Connect (PSC) Limits](/apigee/docs/api-platform/reference/limits#private-service-connect-psc).\n| - If a Google cloud project is removed from `consumerAcceptList`, the existing PSC NEGs in that removed project will continue to work. However, any new NEGs will be rejected. You must delete existing NEGs if you remove their associated projects from the `consumerAcceptList`. Alternatively, you can recreate the Apigee instance, which recreates the service attachment in the Apigee project.\n\nUpdating the consumer accept list for an Apigee instance\n--------------------------------------------------------\n\nOn October 10, 2024, the limit on PSC NEG connections allowed per project to an Apigee instance was raised from\n20 to 100. For any Apigee instances created before that date, you must perform the steps in\nthis section to update the consumer accept list to take advantage of the new limit. You only need to upgrade each\nApigee instance once to receive the new connection limit. See also\n[Private Service Connect (PSC) Limits](/apigee/docs/api-platform/reference/limits#private-service-connect-psc).\n\nIf you need to have more than 1000 PSC NEG connections in total across all of the\nCloud projects connected to an Apigee instance, contact [Google Cloud Support](/apigee/docs/support/getting-started-with-support).\n\nTo update the consumer accept list of an Apigee instance\nto take advantage of the higher connection limit, do the following steps: \n\n### Cloud console\n\nFor detailed steps, see [Edit the accepted projects list](/apigee/docs/api-platform/system-administration/instances#accepted-projects).\n\n### Apigee API\n\nEdit the existing consumer accept list for your Apigee\ninstance. To use the [instances\nAPI](/apigee/docs/reference/apis/apigee/rest/v1/organizations.instances):\n\n1. Get the authentication token for the Apigee API: \n\n ```\n TOKEN=\"$(gcloud auth print-access-token)\"\n ```\n2. Get the list of Cloud projects in an instance's consumer accept list: \n\n ```\n curl https://apigee.googleapis.com/v1/organizations/PROJECT_ID/instances/INSTANCE_ID \\\n -H \"Authorization: Bearer $TOKEN\" -H Content-Type:application/json | jq .consumerAcceptList\n ```\n3. Create a JSON file named `update_consumer_accept_list.json` that contains the current list of accepted projects returned by the previous command. For example: \n\n ```\n {\n \"consumerAcceptList\": [\n \"dg-runtime-test1\",\n \"ne24b79b92c7db623p-tp\",\n \"dg-runtime-test2\",\n \"jd2fee78402218863p-tp\"\n ]\n }\n ```\n4. Optionally, edit the file to add more projects.\n5. Update the instance, using the JSON file you created as input. For example: \n\n ```\n curl https://apigee.googleapis.com/v1/organizations/PROJECT_ID/instances/INSTANCE_ID?updateMask=\"consumer_accept_list\" \\\n -X PATCH -H \"Authorization: Bearer $TOKEN\" -H Content-Type:application/json -d @update_consumer_accept_list.json\n ```\n\nConfigure PSC routing\n---------------------\n\n\nWe support using PSC for northbound routing from both internal and external clients. For detailed steps,\nsee [Step 8: Configure routing](/apigee/docs/api-platform/get-started/install-cli#configure-routing) of\nthe CLI provisioning instructions.\n\nMulti-region expansion with PSC\n-------------------------------\n\nYou can expand an Apigee organization across multiple regions and use PSC for northbound routing in the new regions. For details, see [Expanding Apigee to multiple regions](/apigee/docs/api-platform/system-administration/multi-region).\n\nDeleting an Apigee instance\n---------------------------\n\n\nTo delete an Apigee instance that uses PSC, follow these steps:\n\n1. [Remove and delete the PSC NEG backend](https://cloud.google.com/load-balancing/docs/cleaning-up-lb-setup#deleting_the_negs) from the external load balancer.\n2. Delete the Apigee runtime instance using the [Apigee API](/apigee/docs/reference/apis/apigee/rest/v1/organizations.instances/delete). This is a long-running operation that can take up to 20 minutes to complete.\n3. Optionally retrieve the long-running operation state using the [Apigee API](/apigee/docs/reference/apis/apigee/rest/v1/organizations.operations/get)."]]
