创建 Private Service Connect 接口时，系统还会创建至少有两个网络接口的虚拟机实例。第一个接口连接到提供方 VPC 网络中的子网。第二个接口用于请求与使用方网络中的网络连接子网的连接。如果接受连接，系统会为此接口分配使用方子网中的内部 IP 地址。
在专用连接的服务提供方一端有一个 VPC 网络，您可以在其中预配服务资源。此影音平台专门为您创建，仅包含您的资源。提供方网络与使用方网络之间的连接是通过 Private Service Connect 接口建立的。
下图展示了一个 Vertex AI Pipelines 架构，其中的使用方网络中启用并管理 Vertex AI API。Vertex AI Pipelines 资源以 Google 管理的基础架构即服务 (IaaS) 的形式部署在服务提供方的 VPC 网络中。由于 Private Service Connect 接口是使用使用方子网中的 IP 地址部署的，因此提供方的网络可以访问使用方学到的路由，这些路由可以跨 VPC 网络、多云环境和本地网络。
Private Service Connect 接口部署选项
如需创建 Private Service Connect 接口，请先在使用方 VPC 中部署与提供方服务位于同一区域的子网。请查看具体服务要求，确保没有您应避免的子网范围。然后，创建一个引用该子网的网络连接。我们建议您将为网络连接分配的子网专用于 Private Service Connect 接口部署。
以下页面介绍了 Vertex AI Private Service Connect 接口的具体用例：
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# About accessing Vertex AI services through Private Service Connect interfaces\n\nSome Vertex AI service producers require you to connect to their\nservices through\n[Private Service Connect interfaces](/vpc/docs/about-private-service-connect-interfaces).\nThese services are listed in the\n[Vertex AI access methods](/vertex-ai/docs/general/netsec-overview#access-methods)\ntable.\n\nWhen a Private Service Connect interface is created, a VM instance with\nat least two network interfaces is also created. The first interface connects to\na subnet in a producer VPC network. The second interface requests a connection\nto the [network attachment](/vpc/docs/about-network-attachments) subnet in a\nconsumer network. If accepted, this interface is assigned an internal IP address\nfrom the consumer subnet.\n\nOn the service producer's side of the private connection, there is a\nVPC network where your service resources are provisioned. This\nnetwork is created exclusively for you and contains only your resources.\nConnectivity between the producer and consumer network is established through the\nPrivate Service Connect interface.\n\nThe following diagram shows a Vertex AI Pipelines architecture in which\nthe Vertex AI API is enabled and managed in the consumer's network. The\nVertex AI Pipelines resources are deployed as a Google-managed\ninfrastructure as a service (IaaS) in the service producer's VPC\nnetwork. Since the Private Service Connect interface is deployed with\nan IP address from the consumer's subnet, the producer's network has access to\nthe consumer's learned routes that can span VPC networks,\nmulticloud environments, and on-premises networks.\n\nPrivate Service Connect interface deployment options\n----------------------------------------------------\n\nTo create a Private Service Connect interface, first deploy a subnet\nwithin the consumer VPC that shares the same region as your producer service.\nCheck the specific service requirements to make sure there are no subnet ranges\nthat you should avoid.\nThen create a network attachment that references the subnet. We recommend\nthat you dedicate the subnet allocated for the network attachment exclusively to\nPrivate Service Connect interface deployments.\n\nThe following pages discuss specific use cases for Vertex AI\nPrivate Service Connect interfaces:\n\n- [Configure Private Service Connect interface for a pipeline](/vertex-ai/docs/pipelines/configure-private-service-connect)\n- [Use Private Service Connect interface for Vertex AI Training](/vertex-ai/docs/training/psc-i-egress)\n- [Create a Ray cluster on Vertex AI](/vertex-ai/docs/open-source/ray-on-vertex-ai/create-cluster#enable_interface)\n\nDeployment considerations\n-------------------------\n\nThe following are considerations for communication from your on-premises,\nmulticloud, and VPC workloads to Google-managed\nVertex AI services.\n\n### Vertex AI subnet recommendations\n\nThe following table lists the recommended subnet ranges for Vertex AI\nservices that support Private Service Connect interfaces.\n\n### IP advertisement\n\n- When you use the Private Service Connect interface to connect to services in the consumer VPC network, you choose an IP address from a [regular subnet](/vpc/docs/subnets#purpose) in your VPC network.\n- By default, the Cloud Router will advertise regular VPC subnets unless custom advertisement mode is configured. For more information, see [Custom advertisement](/network-connectivity/docs/router/concepts/advertised-routes#am-custom).\n- A connection between a network attachment and a Private Service Connect interface is [transitive](/vpc/docs/about-private-service-connect-interfaces#other-networks). Workloads in the producer VPC network can communicate with workloads that are connected to the consumer VPC network.\n\n### Firewall rules\n\nPrivate Service Connect interfaces are created and managed by a\nproducer organization, but they are located in a consumer VPC\nnetwork. For consumer-side security, we recommend firewall rules that are based\non IP address ranges from the consumer VPC network. You must\nupdate firewall rules to allow the network attachment subnet access to the\nconsumer's network. For more information, see\n[Limit producer-to-consumer ingress](/vpc/docs/configure-security-network-attachments#producer-to-consumer-ingress).\n\n### Domain name resolution\n\nWhen using Vertex AI APIs that support Private Service Connect\ninterfaces, domain name resolution lookup isn't supported. If you're using a\npublic domain, DNS lookup is supported within the producer's network. For\nprivate DNS lookup, you must define hostname variables that are mapped to\nconsumer Layer 3 IP addresses.\n\nWhat's next\n-----------\n\n- Learn about [network attachment specifications](/vpc/docs/about-network-attachments#specifications).\n- Try a [codelab on using Private Service Connect interfaces with Vertex AI Pipelines](https://codelabs.developers.google.com/psc-interface-pipelines)."]]
