PSC 서비스 연결과 부하 분산기는 같은 VPC 내 서로 다른 서브넷에서 생성됩니다. 특히 서비스 연결은 항상 NAT 서브넷에서 생성됩니다.
부하 분산기와 상태 점검 프로브의 트래픽을 같은 포트로 보내야 합니다.
트래픽 흐름을 용이하게 하도록 방화벽 규칙을 구성하세요.
인그레스 규칙
PSC 서비스 연결 서브넷에서 들어오는 트래픽이 백엔드 서비스에 도달해야 합니다.
이그레스 규칙
이그레스 트래픽은 특정 거부 규칙이 구성되지 않는 한 Google Cloud 프로젝트에서 기본적으로 사용 설정됩니다.
PSC 서비스 연결 및 부하 분산기와 같은 모든 Google Cloud 구성요소는 같은 리전에 있어야 합니다.
PSC 서비스 연결 만들기
Integration Connectors에서 비공개 연결을 설정하려면 PSC 서비스 연결을 사용하여 서비스를 Integration Connectors에 노출해야 합니다. 서비스 연결은 항상 부하 분산기를 사용합니다. 따라서 서비스가 부하 분산기 뒤에 있지 않으면 부하 분산기를 구성해야 합니다.
이 명령어에서 LIMIT는 프로젝트의 연결 한도입니다. 연결 한도는 이 서비스에 연결할 수 있는 소비자 PSC 엔드포인트의 수입니다. SERVICE_DIRECTORY_PROJECT_ID를 가져오려면 다음 단계를 따르세요.
지정된 Google Cloud 프로젝트의 요청만 수락하도록 PSC 서비스 연결을 만들 수 있습니다. 하지만 이렇게 하려면 Google Cloud 프로젝트와 연결된 서비스 디렉터리의 프로젝트 ID가 필요합니다. 서비스 디렉터리의 프로젝트 ID를 가져오려면 다음 예시와 같이 List Connections API를 사용할 수 있습니다.
TLS 지원 백엔드와 같은 일부 경우에는 대상에서 TLS 유효성 검사를 실행하기 위해 비공개 IP 대신 호스트 이름을 사용해야 합니다. 호스트 대상에 대한 IP 주소 대신 비공개 DNS가 사용되는 경우 엔드포인트 연결을 IP 주소로 만드는 것 외에도 관리형 영역을 구성해야 합니다. 호스트 이름으로 엔드포인트 연결을 만드는 방법에 관한 안내는 호스트 이름으로 엔드포인트 연결 만들기를 참고하세요.
나중에 엔드포인트 연결을 사용하도록 연결을 구성할 때 이 엔드포인트 연결을 선택할 수 있습니다.
엔드포인트 연결을 사용하도록 연결 구성
이제 엔드포인트 연결을 만들었으므로 연결에서 엔드포인트 연결을 사용합니다. 새 연결을 만들거나 기존 연결을 업데이트할 때는 대상 섹션에서 대상 유형으로 엔드포인트 연결을 선택하고 엔드포인트 연결 목록에서 만든 엔드포인트 연결을 선택합니다.
관리형 영역을 만든 경우 대상 유형으로 호스트 주소를 선택하고 관리형 영역을 만들 때 만든 A 레코드를 사용합니다.
문제해결 도움말
일반적인 문제를 방지하려면 이 섹션에 나열된 가이드라인을 따르세요.
엔드포인트 연결이 올바르게 설정되고 PSC 연결이 설정되었는지 확인하려면 연결 상태를 확인합니다. 자세한 내용은 엔드포인트 연결 확인을 참고하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-08(UTC)"],[[["\u003cp\u003eIntegration Connectors can be configured to connect to services in serverless environments like Cloud Run through private network connectivity.\u003c/p\u003e\n"],["\u003cp\u003eEstablishing private connectivity requires exposing the service to Integration Connectors using a Private Service Connect (PSC) service attachment, which uses a load balancer.\u003c/p\u003e\n"],["\u003cp\u003eThe PSC service attachment and load balancer must be in the same region but in different subnets within the same VPC, with the service attachment always in a NAT subnet.\u003c/p\u003e\n"],["\u003cp\u003eFirewall rules need configuration to allow ingress traffic from the PSC service attachment's subnet to the backend service, and egress traffic is generally enabled by default.\u003c/p\u003e\n"],["\u003cp\u003eEndpoint attachments, either as IP addresses or hostnames, can be created and used to connect, and in the case of hostnames, managed zones are also necessary.\u003c/p\u003e\n"]]],[],null,["# Connectivity to services hosted in serverless environment\n=========================================================\n\nThis page describes how you can configure Integration Connectors to connect to services hosted in serverless environments such as Cloud Run in Google Cloud.\n\nThe following image shows a private network connectivity setup from Integration Connectors to a service hosted in the Cloud Run environment in Google Cloud:\n\n\nThis page assumes that you are familiar with the following concepts:\n\n- [Endpoint attachments](/integration-connectors/docs/network-connectivity-private#endpoint-attachments)\n- [Managed zones](/dns/docs/zones)\n- [Private Service Connect (PSC)](/vpc/docs/private-service-connect)\n- [Google Cloud load balancer](/load-balancing)\n\n### Considerations\n\nWhen you create a PSC service attachment, consider the following key points:\n\n- The PSC service attachment and the load balancer are created in different subnets within the same VPC. And specifically, the service attachment is always created in a NAT subnet.\n- Traffic from load balancer and health check probe must be sent to the same port.\n- Configure the firewall rules to facilitate the traffic flow. **Ingress rules**\n\n Traffic from the PSC service attachment's subnet must reach your backend service.\n\n\n **Egress rules**\n\n Egress traffic is enabled by default in a Google Cloud project, unless specific\n deny rules are configured.\n- All your Google Cloud components such as the PSC service attachment and the load balancer must be in the same region.\n\n### Create a PSC service attachment\n\nIn order to establish private connectivity from Integration Connectors, your service must be exposed to Integration Connectors using a PSC service attachment. A service attachment always uses a load balancer. Therefore, if your service isn't behind a load balancer, a load balancer needs to be configured.\n| The steps described in this section assume that you already have your backend service installed and configured.\n\n1. Create a load balancer. If you already have a load balancer, skip this step. Create an application load balancer using serverless NEG as the backend by following the instructions at [Set up a regional internal Application Load Balancer with Cloud Run](/load-balancing/docs/l7-internal/setting-up-l7-internal-serverless).\n\n2. Create the service attachment\n 1. Create a subnet for PSC NAT. The following command creates a subnet with the name `psc-nat-subnet1` and the purpose is `PRIVATE_SERVICE_CONNECT`. \n\n ```scdoc\n gcloud compute networks subnets create psc-nat-subnet1 \\\n --network=VPC_NETWORK --range=SUBNET_RANGE_1 \\\n --purpose=PRIVATE_SERVICE_CONNECT\n ```\n 2. Create a firewall rule to allow traffic from the PSC NAT to the load balancer. \n\n ```component-pascal\n gcloud compute network-firewall-policies rules create PRIORITY --firewall-policy FIREWALL_POLICY_NAME_SA \\\n --direction=INGRESS --network=VPC_NETWORK \\\n --action=allow --allow=tcp:BACKEND_SERVER_PORT --src-ip-ranges=SUBNET_RANGE_1\n ```\n 3. Create service attachment with [explicit approval](/vpc/docs/configure-private-service-connect-producer#publish-service-explicit). \n\n ```scdoc\n gcloud compute service-attachments create SERVICE_ATTACHMENT_NAME --producer-forwarding-rule=FORWARDING_RULE_NAME --connection-preference=ACCEPT_MANUAL --consumer-accept-list=SERVICE_DIRECTORY_PROJECT_ID=LIMIT --nat-subnets=psc-nat-subnet1\n ```\n\n In this command, \u003cvar translate=\"no\"\u003eLIMIT\u003c/var\u003e is the connection limit for the project. The connection limit is the number of consumer\n PSC endpoints that can connect to this service. To get the \u003cvar translate=\"no\"\u003eSERVICE_DIRECTORY_PROJECT_ID\u003c/var\u003e, do the following step:\n - You can create the PSC service attachment such that it accepts requests only from the specified Google Cloud projects. However, to do this,\n you need the project ID of the service directory associated with your Google Cloud project. To get the project ID of the service directory, you can use\n the [List Connections API](/integration-connectors/docs/reference/rest/v1/projects.locations.connections/list) as shown in the following\n example.\n\n | **Note:** Before getting the project ID, ensure that at least one connection is present in your project.\n\n ### Syntax\n\n ```json\n curl -X GET \\\n -H \"authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n \"https://connectors.googleapis.com/v1/projects/\u003cvar translate=\"no\"\u003eCONNECTORS_PROJECT_ID\u003c/var\u003e/locations/-/connections\"\n ```\n\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCONNECTORS_PROJECT_ID\u003c/var\u003e: The ID of your Google Cloud project where you created your connection.\n\n ### Example\n\n This example gets the project ID of the service directory for the `connectors-test` Google Cloud project. \n\n ```json\n curl -X GET \\\n -H \"authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n \"https://connectors.googleapis.com/v1/projects/connectors-test/locations/-/connections\"\n ```\n\n Running this command on the terminal displays an output similar to the following: \n\n ```json\n .....\n {\n \"connections\": [\n {\n \"name\": \"projects/connectors-test/locations/asia-northeast1/connections/big-query-iam-invalid-sa\",\n \"createTime\": \"2022-10-07T09:02:31.905048520Z\",\n \"updateTime\": \"2022-10-07T09:22:39.993778690Z\",\n \"connectorVersion\": \"projects/connectors-test/locations/global/providers/gcp/connectors/bigquery/versions/1\",\n \"status\": {\n \"state\": \"ACTIVE\"\n },\n \"configVariables\": [\n {\n \"key\": \"project_id\",\n \"stringValue\": \"connectors-test\"\n },\n {\n \"key\": \"dataset_id\",\n \"stringValue\": \"testDataset\"\n }\n ],\n \"authConfig\": {},\n \"serviceAccount\": \"564332356444-compute@developer.gserviceaccount.com\",\n \"serviceDirectory\": \"projects/abcdefghijk-tp/locations/asia-northeast1/namespaces/connectors/services/runtime\",\n \"nodeConfig\": {\n \"minNodeCount\": 2,\n \"maxNodeCount\": 50\n }\n },\n ....\n ```\n\n In the sample output, for the `connectors-test` Google Cloud project, the project ID\n of the service directory is `abcdefghijk-tp`.\n\n### Create an endpoint attachment to consume the PSC service attachment\n\n**Endpoint attachment as an IP address**\n\nFor instructions on how to create an endpoint attachment as an IP address,\nsee [Create an endpoint attachment as an IP address](/integration-connectors/docs/create-endpoint-attachment#create-ep-ipaddr).\n**Endpoint attachment as a hostname**\n\nIn certain cases such as TLS enabled backends, the destination requires you to use\nhostnames instead of private IPs to perform TLS validation. In those cases where a private\nDNS is used instead of an IP address for the host destination, in addition to creating an endpoint\nattachment as an IP address, you must also configure managed zones. For instructions on how to\ncreate an endpoint attachment as a hostname,\nsee [Create an endpoint attachment as a hostname](/integration-connectors/docs/create-endpoint-attachment#create-ep-hostname).\n\nLater, when you configure your connection to use the endpoint attachment, you can select this endpoint attachment.\n\n### Configure a connection to use the endpoint attachment\n\nNow that you have created an endpoint attachment, use the endpoint attachment in your connection. When you create a new connection or update an existing connection, in the Destinations section, select **Endpoint attachment** as the **Destination Type** and select the endpoint attachment that you created from the **Endpoint Attachment** list.\n\nIf you created a managed zone, select **Host Address** as the **Destination Type** and use the A-record that you created while creating the managed zone.\n\nTroubleshooting tips\n--------------------\n\nFollow the guidelines listed in this section to avoid common issues:\n\n- To verify that the endpoint attachment is set up correctly and the PSC connection is established, check the connection status. For more information, see [Verify the endpoint attachment connection](/integration-connectors/docs/create-endpoint-attachment#verify-ep-connection).\n- For information about troubleshooting Load Balancer issues, see [Troubleshoot issues with internal Application Load Balancers](/load-balancing/docs/l7-internal/troubleshooting-l7-ilb).\n- [Google Cloud Connectivity test](/network-intelligence-center/docs/connectivity-tests/concepts/overview) can be used to identify any gaps in your network configuration. For more information, see [Create and run Connectivity Tests](/network-intelligence-center/docs/connectivity-tests/how-to/running-connectivity-tests)."]]
