Access managed services using Private Service Connect
Private Service Connect lets you connect to service producers using endpoints with internal IP addresses in your VPC network.
This document explains how to use Private Service Connect endpoints to connect to supported managed services in another VPC network. You can connect to your own services, or those provided by other service producers. See publish managed services for more information.
Roles
The following IAM role provides the permissions needed to perform the tasks in this guide.
Task | Roles |
---|---|
Create a Private Service Connect endpoint |
Both of these roles: Compute Network Admin ( roles/compute.networkAdmin ) and
Service Directory Editor ( roles/servicedirectory.editor )
|
Automatically or manually configure DNS entries for a Private Service Connect endpoint |
DNS Administrator
(roles/dns.admin )
|
Before you begin
You must enable the Compute Engine API in your project.
You must enable the Service Directory API in your project.
You must enable the Cloud DNS API in your project.
Egress firewall rules must permit traffic to the internal IP address of the Private Service Connect endpoint. The implied allow egress firewall rule permits egress to any destination IP address.
If you've created any egress deny firewall rules in your VPC network, or if you've created hierarchical firewall policies which modify the implied allowed egress behavior, access to the endpoint might be affected. Create a specific egress allow firewall rule or policy to permit traffic to the service endpoint's internal IP address destination.
You must have the URI of the service attachment for the service. For example,
projects/SERVICE_PROJECT/regions/REGION/serviceAttachments/SERVICE_NAME
Limitations
You can't create a Private Service Connect endpoint in the same VPC network as the published service that you are accessing.
Private Service Connect endpoints are not accessible from peered VPC networks.
Packet Mirroring can't mirror packets for Private Service Connect published services traffic.
Automatic DNS configuration
If the following configurations are present, DNS entries are automatically created for Private Service Connect endpoints:
The service producer has configured a domain name for the service.
The Private Service Connect endpoint is registered with a Service Directory namespace.
All new endpoints are automatically registered with Service Directory, but older endpoints might not be registered.
If both configurations are present, when the Private Service Connect
endpoint is created, a Service Directory DNS
zone is created
with the name: NAMESPACE--REGION
.
This private zone stores DNS entries for services found in the
Service Directory namespace NAMESPACE
, in
region REGION
.
After you create the Private Service Connect endpoint, you can verify if a Service Directory DNS zone is created. If the Service Directory DNS zone is not created, you can manually create a similar configuration. For more information, see View Service Directory DNS zones.
If you don't want these DNS entries to be created, do one of the following:
If you're not using Cloud DNS for another purpose, disable the Cloud DNS API, or remove the permissions that are required for Cloud DNS.
Wait for the DNS zone to be created, then Delete the DNS zone manually.
If you want to manually configure DNS, see Configure DNS manually.
Create a Private Service Connect endpoint
A Private Service Connect endpoint connects to services in another VPC network using a Private Service Connect forwarding rule. Each forwarding rule counts toward the per project quota for Private Service Connect forwarding rules to access services in another VPC network.
When you use Private Service Connect to connect to services in another VPC network, you choose an IP address from a subnet in your VPC network.
The IP address must be in the same region as the service producer's service attachment. The IP address counts toward the project's quota for Internal IP addresses.
When you create a Private Service Connect endpoint, it is
automatically registered with
Service Directory, using
a namespace that you choose, or the default namespace, goog-psc-default
.
Console
In the Google Cloud console, go to Private Service Connect.
Click the Connected endpoints tab.
Click Connect endpoint.
For Target, select Published service.
For Target service, enter the service attachment URI that you want to connect to.
The service attachment URI is in this format:
projects/SERVICE_PROJECT/regions/REGION/serviceAttachments/SERVICE_NAME
For Endpoint name, enter a name to use for the endpoint.
Select a Network for the endpoint.
Select a Subnetwork for the endpoint.
Select an IP address for the endpoint. If you need a new IP address, you can create one:
- Click the IP address drop-down menu and select Create IP address.
- Enter a Name and optional Description for the IP address.
For Static IP address, select Assign automatically or Let me choose.
If you selected Let me choose, enter the Custom IP address you want to use.
Click Reserve.
Select a Namespace from the drop-down list or create a new namespace.
The Region is populated based on the selected subnetwork.
Click Add endpoint.
gcloud
Reserve an internal IP address to assign to the endpoint.
gcloud compute addresses create ADDRESS_NAME \ --region=REGION \ --subnet=SUBNET
Replace the following:
ADDRESS_NAME
: the name to assign to the reserved IP address.REGION
: the region for the endpoint IP address. This must be the same region that contains the service producer's service attachment.SUBNET
: the name of the subnet for the endpoint IP address.
Find the reserved IP address.
gcloud compute addresses list --filter="name=ADDRESS_NAME"
Create a forwarding rule to connect the endpoint to the service producer's service attachment.
gcloud compute forwarding-rules create ENDPOINT_NAME \ --region=REGION \ --network=NETWORK_NAME \ --address=ADDRESS_NAME \ --target-service-attachment=SERVICE_ATTACHMENT \ [ --service-directory-registration=projects/PROJECT_ID/locations/REGION/namespaces/NAMESPACE ]
Replace the following:
ENDPOINT_NAME
: the name to assign to the endpoint.REGION
: the region for the endpoint. This must be the same region that contains the service producer's service attachment.NETWORK_NAME
: the name of the VPC network for the endpoint.ADDRESS_NAME
: the name of the reserved address.SERVICE_ATTACHMENT
: the URI of the service producer's service attachment. For example:projects/SERVICE_PROJECT/regions/REGION/serviceAttachments/SERVICE_NAME
PROJECT_ID
: your project ID.NAMESPACE
: the Service Directory namespace that you want to use. If you specify a namespace that doesn't exist, the namespace is created.If you omit the
--service-directory-registration
flag, the default namespace ofgoog-psc-default
is used.
API
Reserve an internal IP address to assign to the endpoint.
POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/region/REGION/addresses { "name": ADDRESS_NAME, "addressType": "INTERNAL", "subnetwork": SUBNET_URI }
Replace the following:
PROJECT_ID
: your project ID.ADDRESS_NAME
: the name to assign to the reserved IP address.SUBNET_URI
: the subnet for the IP address. Use the subnetworks.list method orgcloud compute networks subnets list --uri
to find the URLs of your networks.
Create a forwarding rule to connect the endpoint to Google APIs and services.
POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/forwardingRules { "name": ENDPOINT_NAME, "IPAddress": ADDRESS_URI, "target": SERVICE_ATTACHMENT, "network": NETWORK_URI, "serviceDirectoryRegistrations": [ { "namespace": NAMESPACE, } ], }
Replace the following:
PROJECT_ID
: your project ID.REGION
: the region for the endpoint.ENDPOINT_NAME
: the name to assign to the endpoint.ADDRESS_URI
: the URI of the reserved address on the associated network. Use the addresses.list method orgcloud compute addresses list --uri
to find the URL of your reserved address.SERVICE_ATTACHMENT
: the URI of the service producer's service attachment. For example:projects/SERVICE_PROJECT/regions/REGION/serviceAttachments/SERVICE_NAME
NETWORK_URI
: the VPC network for the endpoint. Use the network.list method orgcloud compute networks list --uri
to find the URI of your network.NAMESPACE
: the namespace for the endpoint. If you specify a namespace that doesn't exist, the namespace is created. If you omit thenamespace
field, the default namespace ofgoog-psc-default
is assigned.
View Service Directory DNS zones
If the prerequisites for automatic DNS configuration are met, a
DNS zone is created with a name in the format
NAMESPACE--REGION
.
Console
In the Google Cloud console, go to the Cloud DNS zones page.
Look for a private zone with the name
NAMESPACE--REGION
.
gcloud
Run the following command to list all private DNS zones:
gcloud dns managed-zones list \ --filter="visibility=private"
Run the following command to get details for a zone with the name
NAMESPACE--REGION
.gcloud dns managed-zones describe NAMESPACE--REGION
If the zone is not present, view the details for the Private Service Connect endpoint and check if the endpoint configuration includes a value for the namespace.
If the endpoint has a namespace configuration, see Configure a Service Directory DNS zone.
If the endpoint does not have a namespace configuration, see Register a Private Service Connect endpoint with Service Directory.
List endpoints
You can list all configured Private Service Connect endpoints.
Console
In the Google Cloud console, go to the Private Service Connect page.
Click the Connected endpoints tab.
The Private Service Connect endpoints are displayed.
gcloud
gcloud compute forwarding-rules list \ --filter 'target~serviceAttachments'
The output is similar to the following:
NAME REGION IP_ADDRESS IP_PROTOCOL TARGET RULE IP TCP REGION/serviceAttachments/SERVICE_NAME
API
This API call returns all forwarding rules, not only Private Service Connect endpoints used to access services.
GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/forwardingRules
Replace the following:
PROJECT_ID
: the project that contains the endpoint.REGION
: the region for the endpoint.
View endpoint details
You can view all configuration details of a Private Service Connect endpoint.
The endpoint can have one of the following statuses:
Pending: the endpoint is configured to connect to a service that requires approval, and approval has not been given to this project yet.
Accepted: the endpoint is in a project that is approved to connect to the service.
Rejected: the endpoint is in a project that is disallowed from connecting to the service.
Closed: the endpoint is connected to a service attachment that has been deleted.
Console
In the Google Cloud console, go to the Private Service Connect page.
Click the Connected endpoints tab.
Click the endpoint that you want to view.
gcloud
gcloud compute forwarding-rules describe \ ENDPOINT_NAME --region=REGION
Replace the following:
ENDPOINT_NAME
: the name of the endpoint.REGION
: the region for the endpoint.
API
GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/forwardingRules/ENDPOINT_NAME
Replace the following:
PROJECT_ID
: the project that contains the endpoint.REGION
: the region for the endpoint.ENDPOINT_NAME
: the name of the endpoint.
Label an endpoint
You can manage labels for Private Service Connect endpoints. See labeling resources for more information.
Delete an endpoint
You can delete a Private Service Connect endpoint.
However, the following Service Directory configurations are not deleted when you delete the endpoint:
- Service Directory namespace
- Service Directory DNS zone
The Service Directory namespace and Service Directory DNS zone can be used by other services. Check that the namespace is empty before you delete the Service Directory namespace or delete the Service Directory DNS zone.
Console
In the Google Cloud console, go to Private Service Connect.
Click the Connected endpoints tab.
Select the Private Service Connect endpoint you want to delete, and click Delete.
gcloud
gcloud compute forwarding-rules delete \ ENDPOINT_NAME --region=REGION
Replace the following:
ENDPOINT_NAME
: the name of the endpoint.REGION
: the region for the endpoint.
API
DELETE https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/forwardingRules/ENDPOINT_NAME
Replace the following:
PROJECT_ID
: the project that contains the endpoint.REGION
: the region for the endpoint.ENDPOINT_NAME
: the name of the endpoint.
Other ways to configure DNS
If the prerequisites for automatic DNS configuration are not met, you can create DNS entries in other ways:
If the endpoint has a namespace configured, see Configure a Service Directory DNS zone.
If the endpoint does not have a namespace configured, see Register a Private Service Connect endpoint with Service Directory.
If you prefer to manually configure DNS, see Configure DNS manually.
Configure a Service Directory DNS zone
If a Private Service Connect endpoint is registered with Service Directory, but the published service that it connects to does not have a domain name configured, no DNS changes are made.
If you want to replicate the automatic DNS configuration, you can manually configure a Service Directory DNS zone that is backed by the Service Directory namespace. After the zone is created, DNS entries for the Private Service Connect endpoint are automatically created.
Create a Service Directory DNS zone with the following configuration:
Zone name: Specify
NAMESPACE--REGION
, whereNAMESPACE
is the namespace that the Private Service Connect endpoint is registered to, andREGION
is the region where the endpoint is created.DNS name: The DNS domain that the service producer is using for their published services. Check with the service producer for this information.
The DNS name might have the format
REGION.p.DOMAIN
. For example, if the service producer's public domain isexample.com
, and their published service is inus-west1
, then we recommend that they make their service available usingus-west1.p.example.com
domain names. Include a trailing dot—for example,us-west1.p.example.com.
Service Directory namespace: The namespace that you configured for this endpoint.
View the Private Service Connect endpoint details to find the Service Directory namespace and region.
With this configuration, if you have configured a
Service Directory DNS zone with the us-west1.p.example.com
DNS
name, and you create a Private Service Connect endpoint with the
name analytics
, a DNS record for analytics.us-west1.p.example.com
is
automatically created.
Register a Private Service Connect endpoint with Service Directory
New Private Service Connect endpoints are automatically registered with Service Directory. However, if a Private Service Connect endpoint was created before automatic registration with Service Directory was enabled, this configuration might be missing.
You can delete the Private Service Connect endpoint and create a new one, which is registered with Service Directory automatically.
Or you can follow these steps to register an existing Private Service Connect endpoint with a Service Directory namespace.
Create a Service Directory namespace for the Private Service Connect endpoint,
NAMESPACE
.Create a Service Directory service for the Private Service Connect endpoint,
SERVICE_NAME
.For the service, use the same name as the name of the forwarding rule used for the Private Service Connect endpoint,
ENDPOINT_NAME
.Create a Service Directory endpoint, using the name
default
and use the IP address and port (443
) of the Private Service Connect endpoint.
After you have registered the Private Service Connect endpoint with Service Directory, follow the instructions to Configure a Service Directory DNS zone.
Configure DNS manually
If you've prevented automatic DNS configuration, or if it is not enabled in your configuration, you can use Cloud DNS to manually create DNS records
For more information, see the following pages:
Access Control: the DNS Administrator role (
roles/dns.admin
) provides the permissions needed to create DNS zones and records.-
When you configure a private zone, you provide a DNS name. Use the DNS domain that the service producer is using for their published services. Check with the service producer for this information.
It might have this format:
REGION.p.DOMAIN
. For example, if the service producer's public domain isexample.com
, and their published service is inus-west1
, then we recommend that they make their service available usingus-west1.p.example.com
domain names.
Logging
You can enable VPC Flow Logs on subnets containing VMs that are accessing services in another VPC network using Private Service Connect endpoints. The logs show flows between the VMs and the Private Service Connect endpoint.
You can view changes in connection status for Private Service Connect endpoints using audit logs. Changes in connection status for the endpoint are captured in system event metadata for the resource type GCE forwarding rule. You can filter for
pscConnectionStatus
to view these entries.For example, when a service producer allows connections from your project, the connection status of the endpoint changes from
PENDING
toACCEPTED
, and this change is reflected in the audit logs.- To view audit logs, see View logs.
- To set alerts based on audit logs, see Managing log-based alerts.
Access the endpoint from on-premises hosts
Clients in networks that are connected to Google Cloud with VLAN attachments for Cloud Interconnect (Preview) or Cloud VPN tunnels can reach Private Service Connect endpoints.
The VLAN attachment or Cloud VPN tunnel must terminate in the same VPC network and region as the Private Service Connect endpoint.
Client traffic from connected networks to Private Service Connect endpoints is not supported across peered VPC networks or across regional boundaries.
The VLAN attachment or Cloud VPN tunnel and the Private Service Connect endpoint can be in different projects if they are using Shared VPC.
The VLAN attachments must have
dataplaneVersion: 2
. Inspect your VLAN attachment to check what version it is on.
If you want to access the Private Service Connect endpoint by using its DNS name, you must configure on-premises systems so that they can make queries to your private DNS zones.
If you implemented the private DNS zones by using Cloud DNS, complete the following steps:
Create an inbound server policy in the VPC network to which your on-premises network connects.
Identify the inbound forwarder entry points in the regions where your Cloud VPN tunnels are located, in the VPC network to which your on-premises network connects.
Configure on-premises systems and on-premises DNS name servers to forward the DNS names for the Private Service Connect endpoints to an inbound forwarder entry point in the same region as the Cloud VPN tunnel that connects to the VPC network.
VPC Service Controls
VPC Service Controls and Private Service Connect are compatible with each other. If the VPC network where the Private Service Connect endpoint is deployed is in a VPC Service Controls perimeter, the Private Service Connect endpoint is part of the same perimeter. Any VPC Service Controls-supported services that are accessed through the Private Service Connect endpoint are subject to the policies of that VPC Service Controls perimeter.
When you create a Private Service Connect endpoint, control-plane API calls are made between the consumer and producer projects to establish a Private Service Connect connection. Establishing a Private Service Connect connection between consumer and producer projects that are not in the same VPC Service Controls perimeter does not require explicit authorization with egress policies. Communication to VPC Service Controls-supported services through the Private Service Connect endpoint is protected by the VPC Service Controls perimeter.
Troubleshooting
Private DNS zone creation fails
When you create a Private Service Connect endpoint, a Service Directory DNS zone is created. Zone creation can fail for these reasons:
You haven't enabled the Cloud DNS API in your project.
You don't have the required permissions to create a Service Directory DNS zone.
A DNS zone with the same zone name exists in this VPC network.
A DNS zone for the same domain name already exists in this VPC network.
To manually create the Service Directory DNS zone, do the following:
Verify that the Cloud DNS API is enabled in your project.
Verify that you have the required permissions to create the Service Directory DNS zone:
dns.managedZones.create
dns.networks.bindPrivateDNSZone
servicedirectory.namespaces.associatePrivateZone
If there is a conflicting zone, but it is no longer needed, delete the DNS zone.
Create a Service Directory DNS zone that is backed by the Service Directory namespace associated with your Private Service Connect endpoint.