Set up a Private Service Connect interface for Vertex AI resources

This guide shows how to set up a Private Service Connect interface for Vertex AI resources.

You can configure Private Service Connect interface connections for certain resources in Vertex AI, including:

Unlike VPC peering connections, Private Service Connect interface connections can be transitive, requiring fewer IP addresses in the consumer VPC network. This allows greater flexibility in connecting to other VPC networks in your Google Cloud project and on-premises.

This guide is recommended for network administrators who are familiar with Google Cloud networking concepts.

Objectives

This guide covers the following tasks:

  • Configure a producer VPC network, subnet, and network attachment.
  • Add firewall rules to your Google Cloud network host project.
  • Create a Vertex AI resource specifying the network attachment to use a Private Service Connect interface.

Before you begin

Use the following instructions to create or select a Google Cloud project and configure it for use with Vertex AI and Private Service Connect.

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  3. Make sure that billing is enabled for your Google Cloud project.

  4. Enable the Vertex AI, Compute Engine, and Cloud Storage APIs.

    Enable the APIs

  5. Install the Google Cloud CLI.

  6. To initialize the gcloud CLI, run the following command: 

    gcloud init

  7. Update and install gcloud components:

    gcloud components update
    gcloud components install beta

  8. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  9. Make sure that billing is enabled for your Google Cloud project.

  10. Enable the Vertex AI, Compute Engine, and Cloud Storage APIs.

    Enable the APIs

  11. Install the Google Cloud CLI.

  12. To initialize the gcloud CLI, run the following command: 

    gcloud init

  13. Update and install gcloud components:

    gcloud components update
    gcloud components install beta
  14. If you're not the project owner, and you don't have the Project IAM Admin (roles/resourcemanager.projectIamAdmin) role, ask the owner to grant you the Compute Network Admin (roles/compute.networkAdmin) role, which includes the required roles you need to manage networking resources.
  15. Assign the Compute Network Admin role of the network host Google Cloud project to the AI Platform Service Agent account of the project where you are using Vertex AI Training services.

Set up a VPC network and subnet

In this section, you can use an existing VPC network or follow the configuration steps to create a new VPC network if you don't have an existing network.

  1. Create a VPC network:

    gcloud compute networks create NETWORK \
    --subnet-mode=custom

    Replace NETWORK with a name for the VPC network.

  2. Create a subnet:

    gcloud compute networks subnets create SUBNET_NAME \
    --network=NETWORK \
    --range=PRIMARY_RANGE \
    --region=REGION

    Replace the following:

    • SUBNET_NAME: a name for the subnet.

    • PRIMARY_RANGE: the primary IPv4 range for the new subnet, in CIDR notation. For more information, see IPv4 subnet ranges.

      Vertex AI requires a /28 subnetwork.

      Vertex AI can only reach the RFC 1918 ranges specified in the required PRIMARY_RANGE. See Valid IPv4 ranges for the list of valid RFC 1918 ranges. Vertex AI can't reach the following non-RFC 1918 ranges:

      • 100.64.0.0/10
      • 192.0.0.0/24
      • 192.0.2.0/24
      • 198.18.0.0/15
      • 198.51.100.0/24
      • 203.0.113.0/24
      • 240.0.0.0/4

    • REGION: the Google Cloud region in which the new subnet is created.

Create a network attachment

In a Shared VPC deployment, create the subnet used for the Network Attachment in the Host Project, followed by creating the Private Service Connect Network Attachment in the Service Project.

The following example shows how to Create a network attachment that manually accepts connections. 

   gcloud compute network-attachments create NETWORK_ATTACHMENT_NAME \
       --region=REGION \
       --connection-preference=ACCEPT_MANUAL \
       --subnets=SUBNET_NAME

Replace NETWORK_ATTACHMENT_NAME with a name for the network attachment.

Vertex AI service agent required role

In the project where you create the network attachment, ensure that the compute.networkAdmin role is granted to the Vertex AI service agent of the same project. You need to enable the Vertex AI API in this project in advance if it's different from the service project where you use Vertex AI.

Configure firewall rules

Ingress firewall rules are applied in the consumer VPC to enable communication with the Private Service Connect interface network attachment subnet from compute and on-premises endpoints.

Configuring firewall rules is optional. However, we recommend that you set common firewall rules as shown in the following examples.

  1. Create a firewall rule that allows SSH access on TCP port 22:

    gcloud compute firewall-rules create NETWORK-firewall1 \
    --network NETWORK \
    --allow tcp:22

  2. Create a firewall rule that allows HTTPS traffic on TCP port 443:

    gcloud compute firewall-rules create NETWORK-firewall2 \
    --network NETWORK \
    --allow tcp:443

  3. Create a firewall rule that allows ICMP traffic (such as ping requests)::

    gcloud compute firewall-rules create NETWORK-firewall3 \
    --network NETWORK \
    --allow tcp:icmp

Troubleshooting

This section lists some common issues when configuring the Private Service Connect interface with Vertex AI.

  • When you configure Vertex AI to use a Shared VPC network, specify the network attachment in the Vertex AI resource. For example, in a CustomJob creation request, use the following format: "projects/YOUR_SHARED_VPC_HOST_PROJECT_NUMBER/regions/REGION/networkAttachments/NETWORK_ATTACHMENT_NAME"
  • If you specify a Shared VPC network for Vertex AI to use, then make sure that the AI Platform Service Agent in the service project has a compute.networkUser role granted in your VPC host project.
  • Network attachments can't be deleted unless the producer (Vertex AI) deletes the allocated resources. To initiate the delete process, you must contact Vertex AI support.

What's next