About Private Service Connect interfaces
This page provides an overview of Private Service Connect interfaces.
A Private Service Connect interface is a resource that lets a producer Virtual Private Cloud (VPC) network initiate connections to various destinations in a consumer VPC network. Producer and consumer networks can be in different projects and organizations.
When you create a Private Service Connect interface, you create a virtual machine (VM) instance that has at least two network interfaces. The first interface connects to a subnet in a producer VPC network. The second interface is a Private Service Connect interface that requests a connection to a network attachment in a consumer network. If the connection is accepted, Google Cloud assigns the Private Service Connect interface an internal IP address from the consumer subnet that is specified by the network attachment.
This Private Service Connect interface connection lets producer and consumer organizations configure their VPC networks so that the two networks are connected and can communicate by using internal IP addresses. For example, the producer organization can update the producer VPC network to add routes for consumer subnets.
A connection between a Private Service Connect interface and a network attachment is similar to the connection between a Private Service Connect endpoint and a service attachment, but it has two key differences:
- A Private Service Connect interface lets a producer VPC network initiate connections to a consumer VPC network (managed service egress). An endpoint works in the reverse direction, letting a consumer VPC network initiate connections to a producer VPC network (managed service ingress).
- A Private Service Connect interface connection is transitive. This means that workloads in a producer network can initiate connections to other workloads that are connected to the consumer VPC network. Private Service Connect endpoints can only initiate connections to the producer VPC network.
Connecting to workloads in other networks
Because Private Service Connect interface connections are transitive, if the consumer VPC network configuration allows it, resources in producer VPC networks can communicate with workloads that are connected to the consumer network. This includes the following:
- Workloads in networks that are connected to the consumer VPC network through Cloud VPN tunnels, Cloud Interconnect, or VPC Network Peering.
- Workloads that have external IP addresses that are reachable from the consumer VPC network through Cloud NAT.
- Google APIs and services that are reachable from the consumer VPC network through Private Google Access or VPC Service Controls. Extra configuration is required to use VPC Service Controls with Private Service Connect interfaces.
- Published services and Google APIs that are reachable from the consumer VPC network through Private Service Connect endpoints and backends.
- Workloads in VPC spokes that are connected to the consumer VPC network.
Example use cases
An example use case for Private Service Connect interfaces is a managed service that needs to initiate connections to a consumer VPC network to access consumer data. The service might also need access to data or services that are available in a consumer's on-premises network, through a VPN or Cloud Interconnect connection, or from a third-party service. A Private Service Connect interface connection can fulfill all of these requirements.
Another use case is a managed service that provides an API gateway. As the service receives calls for different APIs, it uses Private Service Connect interfaces to initiate connections to consumer VPC networks. The gateway service sends API requests to backend targets that process the requests.
Private Service Connect interfaces and Private Service Connect endpoints are complementary and can be used together in the same VPC network.
For example, figure 4 describes the network configuration of a managed service that provides analytics. The analytics service can initiate connections to the consumer VPC network by using a Private Service Connect interface. A Private Service Connect endpoint in the consumer network lets the analytics service initiate connections to a database service in another VPC network. Traffic from the analytics service to the database service passes through the consumer network, which lets the consumer monitor and provide security for traffic between the two services.
Specifications
- A Private Service Connect interface is a special type of network interface that connects to a network attachment. Network interface specifications also apply to Private Service Connect interfaces.
- When you create a VM for Private Service Connect interfaces,
you create at least two network interfaces. The first network interface is
always the default network interface, named
nic0
. This interface connects to a producer subnet. The second interface is a Private Service Connect interface that requests a connection to a consumer subnet. You can include up to seven Private Service Connect interfaces on a single VM. - When a consumer project accepts a connection
from a Private Service Connect interface, Google Cloud
configures the interface with IP addresses from the network attachment's
subnet:
- An internal IPv4 address is assigned from the subnet's primary IP address range.
- If the network attachment's subnet is dual-stack, and the Private Service Connect interface is dual-stack, an internal IPv6 address is assigned from the subnet's IPv6 range.
- Private Service Connect interfaces support alias IP ranges. Alias IP ranges must come from the primary IPv4 address range of the network attachment's subnet.
- Google Cloud ensures that IP addresses that are allocated to a Private Service Connect interface don't overlap with the address ranges of subnets that are connected to the VM's other network interfaces. If there aren't enough addresses available, the creation of the VM fails.
- A Private Service Connect interface communicates in the same way as a network interface.
- A connection between a network attachment and a Private Service Connect interface is bi-directional and transitive. Workloads in the producer VPC network can initiate connections to workloads that are connected to the consumer VPC network.
Limitations
A Private Service Connect interface connection can only be terminated in the following ways:
- A producer deletes the interface's VM.
- A consumer deletes a project that is connected to a Private Service Connect interface. This action stops the interface's VM.
- A consumer disables the Compute Engine API in a project that is connected to a Private Service Connect interface. This action stops the interface's VM.
Private Service Connect interfaces don't support external IP addresses.
A Private Service Connect interface can't be the next hop of an internal forwarding rule.
You can't directly associate Private Service Connect interfaces with Google Kubernetes Engine (GKE) nodes or Pods. However, service egress is possible with GKE through Private Service Connect interfaces that are configured on proxy VMs.
Pricing
Pricing for Private Service Connect interfaces is described on the VPC pricing page.
What's next
- Learn how to Create and manage Private Service Connect interfaces.
- Complete the Private Service Connect interface managed services Codelab.