建立 Private Service Connect 介面時，系統也會建立至少有兩個網路介面的 VM 執行個體。第一個介面會連線至供應者虛擬私有雲網路中的子網路。第二個介面會要求連線至消費者網路中的網路連結子網路。如果接受，系統會從使用者子網路指派內部 IP 位址給這個介面。
私人連線的服務供應商端是虛擬私人雲端網路，其中佈建了您的服務資源。這個網路是專為您建立，並且只包含您的資源。供應端和用戶端網路之間的連線會透過 Private Service Connect 介面建立。
下圖顯示 Vertex AI Pipelines 架構，其中 Vertex AI API 會在消費者的網路中啟用及管理。Vertex AI 管道資源會在服務供應者的虛擬私人雲端網路中，以 Google 管理的基礎架構式服務 (IaaS) 形式部署。由於 Private Service Connect 介面是使用來自使用者子網路的 IP 位址部署，因此供應者網路可存取使用者學習的路徑，這些路徑可跨越 VPC 網路、多雲環境和內部網路。
Private Service Connect 介面部署選項
如要建立 Private Service Connect 介面，請先在用戶端虛擬私有雲中部署子網路，該子網路必須與供應商服務位於相同區域。請查看特定服務規定，確認沒有任何應避免的子網路範圍。然後建立參照子網路的網路附件。建議您將為網路附件分配的子網路專門用於 Private Service Connect 介面部署作業。
以下頁面將說明 Vertex AI Private Service Connect 介面的具體用途：
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# About accessing Vertex AI services through Private Service Connect interfaces\n\nSome Vertex AI service producers require you to connect to their\nservices through\n[Private Service Connect interfaces](/vpc/docs/about-private-service-connect-interfaces).\nThese services are listed in the\n[Vertex AI access methods](/vertex-ai/docs/general/netsec-overview#access-methods)\ntable.\n\nWhen a Private Service Connect interface is created, a VM instance with\nat least two network interfaces is also created. The first interface connects to\na subnet in a producer VPC network. The second interface requests a connection\nto the [network attachment](/vpc/docs/about-network-attachments) subnet in a\nconsumer network. If accepted, this interface is assigned an internal IP address\nfrom the consumer subnet.\n\nOn the service producer's side of the private connection, there is a\nVPC network where your service resources are provisioned. This\nnetwork is created exclusively for you and contains only your resources.\nConnectivity between the producer and consumer network is established through the\nPrivate Service Connect interface.\n\nThe following diagram shows a Vertex AI Pipelines architecture in which\nthe Vertex AI API is enabled and managed in the consumer's network. The\nVertex AI Pipelines resources are deployed as a Google-managed\ninfrastructure as a service (IaaS) in the service producer's VPC\nnetwork. Since the Private Service Connect interface is deployed with\nan IP address from the consumer's subnet, the producer's network has access to\nthe consumer's learned routes that can span VPC networks,\nmulticloud environments, and on-premises networks.\n\nPrivate Service Connect interface deployment options\n----------------------------------------------------\n\nTo create a Private Service Connect interface, first deploy a subnet\nwithin the consumer VPC that shares the same region as your producer service.\nCheck the specific service requirements to make sure there are no subnet ranges\nthat you should avoid.\nThen create a network attachment that references the subnet. We recommend\nthat you dedicate the subnet allocated for the network attachment exclusively to\nPrivate Service Connect interface deployments.\n\nThe following pages discuss specific use cases for Vertex AI\nPrivate Service Connect interfaces:\n\n- [Configure Private Service Connect interface for a pipeline](/vertex-ai/docs/pipelines/configure-private-service-connect)\n- [Use Private Service Connect interface for Vertex AI Training](/vertex-ai/docs/training/psc-i-egress)\n- [Create a Ray cluster on Vertex AI](/vertex-ai/docs/open-source/ray-on-vertex-ai/create-cluster#enable_interface)\n\nDeployment considerations\n-------------------------\n\nThe following are considerations for communication from your on-premises,\nmulticloud, and VPC workloads to Google-managed\nVertex AI services.\n\n### Vertex AI subnet recommendations\n\nThe following table lists the recommended subnet ranges for Vertex AI\nservices that support Private Service Connect interfaces.\n\n### IP advertisement\n\n- When you use the Private Service Connect interface to connect to services in the consumer VPC network, you choose an IP address from a [regular subnet](/vpc/docs/subnets#purpose) in your VPC network.\n- By default, the Cloud Router will advertise regular VPC subnets unless custom advertisement mode is configured. For more information, see [Custom advertisement](/network-connectivity/docs/router/concepts/advertised-routes#am-custom).\n- A connection between a network attachment and a Private Service Connect interface is [transitive](/vpc/docs/about-private-service-connect-interfaces#other-networks). Workloads in the producer VPC network can communicate with workloads that are connected to the consumer VPC network.\n\n### Firewall rules\n\nPrivate Service Connect interfaces are created and managed by a\nproducer organization, but they are located in a consumer VPC\nnetwork. For consumer-side security, we recommend firewall rules that are based\non IP address ranges from the consumer VPC network. You must\nupdate firewall rules to allow the network attachment subnet access to the\nconsumer's network. For more information, see\n[Limit producer-to-consumer ingress](/vpc/docs/configure-security-network-attachments#producer-to-consumer-ingress).\n\n### Domain name resolution\n\nWhen using Vertex AI APIs that support Private Service Connect\ninterfaces, domain name resolution lookup isn't supported. If you're using a\npublic domain, DNS lookup is supported within the producer's network. For\nprivate DNS lookup, you must define hostname variables that are mapped to\nconsumer Layer 3 IP addresses.\n\nWhat's next\n-----------\n\n- Learn about [network attachment specifications](/vpc/docs/about-network-attachments#specifications).\n- Try a [codelab on using Private Service Connect interfaces with Vertex AI Pipelines](https://codelabs.developers.google.com/psc-interface-pipelines)."]]
