About Private Service Connect backends

You can access Google APIs and published services by creating a Private Service Connect endpoint (based on a forwarding rule) or a Private Service Connect backend (based on a load balancer). This guide focuses on Private Service Connect backends.

Private Service Connect backends use a load balancer configured with Private Service Connect network endpoint group (NEG) backends. This configuration was previously referred to as a Private Service Connect endpoint with consumer HTTP(S) service controls.

Accessing APIs and services through a consumer-managed load balancer provides several benefits. Load balancers can act as a centralized policy enforcement point where security or routing policies are enforced. They provide centralized metrics and logging that a published service might not provide, and they allow consumers to control their own routing and failover.

Figure 1 shows a load balancer with a Private Service Connect NEG connecting to a published service. Client traffic goes to a load balancer that processes the traffic and then routes it to a Private Service Connect backend that maps to a published service that runs in a different VPC network.

Figure 1. Using a global external HTTP(S) load balancer lets service consumers with internet access send traffic to services in the service producer's VPC network (click to enlarge).

Deployment overview

To access APIs and services through Private Service Connect backends, do the following:

  1. Identify the API or service that you want to connect to.

    For Google APIs: Select a regional service endpoint.

    For published services: Ask the service producer for the service attachment URI.

  2. Deploy a load balancer to send traffic to your published service. Choose a load balancer that fits your requirements, including whether you have internet clients, internal clients, or require regional isolation. You can also reuse an existing load balancer.

  3. Deploy the Private Service Connect NEGs and add them to your load balancer backend service. Create Private Service Connect NEGs that reference your published service. Then add the NEGs to the load balancer's backend service so that the load balancer can send them traffic.

Supported load balancers and targets

You can use a backend to access a published service or a regional Google API.

Published service targets

This table describes which load balancers can use a Private Service Connect backend to access published services.

For an example backend configuration that uses a global external HTTP(S) load balancer, see Access published services through backends.

To publish a service, see Publish services.

Configuration Details
Consumer configuration (Private Service Connect backend)

Supported consumer load balancers

  • Global external HTTP(S) load balancer (supports multiple regions)

    Note: Global external HTTP(S) load balancer (classic) is not supported.

  • Regional internal HTTP(S) load balancer
  • Regional external HTTP(S) load balancer
  • Internal regional TCP proxy load balancer (Preview)
  • External regional TCP proxy load balancer (Preview)
Producer configuration (published service)
Supported producer load balancer Internal TCP/UDP load balancer

Google API targets

This table describes which load balancers can use a Private Service Connect backend to access Google APIs.

For an example configuration that uses a regional internal HTTP(S) load balancer, see Access Google APIs through backends.

Configuration Details
Consumer configuration (Private Service Connect backend)
Supported consumer load balancers
  • Regional internal HTTP(S) load balancer
  • Regional external HTTP(S) load balancer
Producer
Supported services Supported regional Google APIs

Specifications

All Private Service Connect backends have the following specifications:

  • Private Service Connect NEGs cannot be mixed with other NEG types in the same backend service. However, self-hosted applications and managed services can both be backends of the same load balancer as long as they are part of separate backend services.
  • Backend services with Private Service Connect NEGs must use HTTPS as the protocol. HTTP is not supported with Private Service Connect NEGs.
  • Backend services with Private Service Connect NEGs do not support health checks. Health check resources are not configured with backend services used for Private Service Connect.
  • Only the supported load balancers can use Private Service Connect NEGs as backends.

Private Service Connect backends that use global external HTTP(S) load balancers have additional specifications:

  • Multiple Private Service Connect NEGs can be in the same backend service as long as they are from different regions. You can't add multiple Private Service Connect NEGs from the same region to the same backend service.
  • Private Service Connect NEGs are automatically configured with outlier detection. Outlier detection lets the load balancer detect failures in published service responses and fail over to remaining healthy regions. The default outlier detection policy can be overridden by applying your own outlier detection configuration to the backend service.

Pricing

For pricing information, see the following sections of the VPC pricing page:

What's next