多區域管理服務是指在多個區域部署或存取的服務。客戶可能會存取位於不同區域的服務，因為服務未在其所在區域提供，或是為了確保高可用性和多區域容錯功能。由於 Google Cloud 支援全球 VPC 網路，因此 Private Service Connect 全球存取權 可讓用戶端從任何區域存取 Private Service Connect 端點。用戶端流量可來自 Compute Engine 虛擬機器 (VM) 執行個體、Cloud VPN 通道，以及 Cloud Interconnect 的 VLAN 連結。
圖 3：具備全球存取權的 Private Service Connect 端點可從任何地區存取 (按一下可放大)。
內部部署和混合式存取
您可以使用 Cloud Interconnect 的 VLAN 連結和 Cloud VPN 通道，將內部部署網路或其他雲端服務供應商連線至虛擬私有雲網路。由於 Google API 的端點和已發布服務的端點均可在全球存取，因此連線網路中的用戶端可以向任何區域的端點傳送要求。不過，您可以在多個區域中部署端點，以更精細的方式控管混合式網路的路由。您可以將混合流量從特定區域轉送至本機端點，以便為流量路徑找出最短的路徑。
圖 4：從已連結的網路可以存取 Private Service Connect 端點和後端 (按一下可放大)。
雙向連線
雖然消費者用戶端通常會啟動與代管服務的連線，但代管服務有時需要啟動與消費者擁有的服務連線。
反向私人連線
反向私人連線是指當消費者反向部署 Private Service Connect 時，讓供應商虛擬私有雲網路中的 VM 和 GKE 叢集啟動至消費者虛擬私有雲網路的流量。在這種情況下，消費者會部署內部負載平衡器和服務連結，並將服務發布給產生器。供應商和使用者可以共同使用 Private Service Connect 的正向和反向連線，建立雙向連線。
圖 5. 反向私人連線可讓消費者和生產端建立雙向連線 (按一下即可放大)。
Private Service Connect 介面
Private Service Connect 介面會在用戶和供應商虛擬私有雲網路之間建立雙向的傳遞連線。用戶和供應商虛擬私有雲網路中的資源，都能透過 Private Service Connect 介面啟動連線。此外，由於連線是遞移的，因此供應者虛擬私有雲網路中的資源可以與連線至消費者虛擬私有雲網路的其他工作負載通訊。舉例來說，供應者虛擬私有雲網路中的 VM 可以透過 Cloud Interconnect 或虛擬私有雲網路對接，存取連線至消費者虛擬私有雲網路的網路中工作負載。
混合式服務
不在 Google Cloud 中的混合式服務，可以位於其他雲端、內部部署環境，或這些位置的任意組合。Private Service Connect 可讓您在其他虛擬私有雲網路中存取混合型服務。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[],[],null,["# Private Service Connect deployment patterns\n===========================================\n\nThis page outlines some common ways to deploy and access\nPrivate Service Connect.\n\nSingle-tenant services\n----------------------\n\nSingle-tenant services are services that are dedicated to a single consumer or\ntenant. The service instance is typically hosted in a separate\nVPC network dedicated for that tenant to isolate it from other\ntenant VPC networks in the producer organization. Each service\nuses a [consumer accept\nlist](/vpc/docs/manage-private-service-connect-services#access) to control which\nprojects can connect to the service. Using the accept list, you can limit access\nto a single tenant. Although only a single tenant can connect to the service,\nthe tenant might create [multiple endpoints or backends](#multi-point) if they\nare connecting from multiple VPC networks.\n[](/static/vpc/images/psc-single-tenant.svg) **Figure 1.** In a single-tenant managed service, the producer deploys\na service in a separate VPC network that is dedicated to that\nconsumer (click to enlarge).\n\nMulti-tenant services\n---------------------\n\nMulti-tenant services are services that multiple consumers or tenants can\naccess. The producer configures the consumer accept list of the service so that\nconsumers in several or any projects can connect to the service. The consumer\naccept list also lets the producer control the number of\nPrivate Service Connect connections that each project can create.\nThese limits help the producer prevent resource or quota exhaustion. If the\nproducer needs to identify which tenant is the source of traffic, they can\nenable the [PROXY\nprotocol](/vpc/docs/about-vpc-hosted-services#proxy-protocol)\non the service.\n[](/static/vpc/images/psc-multi-tenant.svg) **Figure 2.** In a multi-tenant managed service, a service in one\nVPC network can be accessed by multiple consumers\n(click to enlarge).\n\nMulti-point access\n------------------\n\nMulti-point access is when multiple Private Service Connect\nendpoints or backends connect to the same service attachment. Multi-point\nPrivate Service Connect is useful for multi-tenant services\nbecause it allows multiple, independent consumers to connect to the same\nservice. It's also useful for single-tenant services for cases such as creating\nservice connectivity across multiple VPC networks within a single consumer.\n\nNot all services producers choose to support multi-point access in their managed\nservice. Contact your service producer to verify if their service attachments\nsupport multi-point access.\n\nMulti-region access\n-------------------\n\nMulti-region managed services are services that are deployed or accessed across\nmultiple regions. Clients might access services in a different region because\nthe service doesn't exist in their local region or for high availability and\nmulti-region failover. Because Google Cloud supports global\nVPC networks, [Private Service Connect global\naccess](/vpc/docs/about-accessing-vpc-hosted-services-endpoints#global-access)\nlets clients reach Private Service Connect endpoints from any\nregion. Client traffic can be from Compute Engine virtual machine (VM) instances,\nCloud VPN tunnels, and VLAN attachments for Cloud Interconnect.\n[](/static/vpc/images/psc-multi-region.svg) **Figure 3.** Private Service Connect endpoints with\nglobal access can be accessed from any region (click to enlarge).\n\nOn-premises and hybrid access\n-----------------------------\n\nYou can connect on-premises networks or other cloud providers to your\nVPC network by using VLAN attachments for\nCloud Interconnect and Cloud VPN tunnels. Because [endpoints\nfor Google APIs](/vpc/docs/about-accessing-google-apis-endpoints) and [endpoints\nfor published services](/vpc/docs/about-accessing-vpc-hosted-services-endpoints)\nare both globally accessible, clients in connected networks can send requests to\nendpoints in any region. However, you can deploy endpoints in multiple regions\nto more granularly control routing from hybrid networks. You can route hybrid\ntraffic from a specific region to a local endpoint which optimizes the shortest\nroute for the traffic path.\n[](/static/vpc/images/hybrid-access.svg) **Figure 4.** Private Service Connect endpoints and\nbackends can be accessed from connected networks (click to enlarge).\n\nBidirectional connectivity\n--------------------------\n\nAlthough consumer clients typically initiate connections to managed services,\nmanaged services sometimes need to initiate connections to consumer-owned\nservices.\n\n### Reverse private connectivity\n\n*Reverse private connectivity* is when a consumer lets VMs and\nGKE clusters in a producer VPC network\ninitiate traffic to a consumer VPC network by deploying\nPrivate Service Connect *in reverse*. In this case, the consumer\ndeploys an internal load balancer and service attachment, which publishes their\nservice to producers. Together, producers and consumers can use\nPrivate Service Connect in a forward and reverse direction\ntogether to create bidirectional connectivity with each other.\n[](/static/vpc/images/psc-reverse.svg) **Figure 5.** Reverse private connectivity lets consumers and producers\ncreate bidirectional connectivity with each other (click to enlarge).\n\n### Private Service Connect interfaces\n\n[Private Service Connect interfaces](/vpc/docs/about-private-service-connect-interfaces) create bidirectional,\ntransitive connections between consumer and producer VPC\nnetworks. Resources in both the consumer and producer\nVPC networks can initiate connections over the\nPrivate Service Connect interface. Additionally, because the\nconnection is transitive, resources in the producer VPC network\ncan communicate with [other workloads that are connected to the consumer\nVPC network](/vpc/docs/about-private-service-connect-interfaces#other-networks).\nFor example, a VM in the producer VPC\nnetwork can reach workloads in networks that are connected to the\nconsumer VPC network through Cloud Interconnect\nor VPC Network Peering.\n\nHybrid services\n---------------\n\nHybrid services that are not located in Google Cloud can be in other\nclouds, in an on-premises environment, or any combination of these locations.\nPrivate Service Connect lets you make a hybrid service accessible\nin another VPC network.\n\nHybrid services can be accessed through [hybrid\nNEGs](/load-balancing/docs/negs/hybrid-neg-concepts)\nwhich are compatible with [supported load\nbalancers](/vpc/docs/private-service-connect-compatibility#endpoints-services).\n\nOften this configuration is used as a form of reverse private connectivity, with\nservice producers making connections to consumer services that are hosted in\non-premises networks. Private Service Connect lets the producer\nreach the consumer hybrid networks without establishing connectivity directly\nwith those networks.\n[](/static/vpc/images/psc-hybrid.svg) **Figure 6.** Reverse private connectivity lets consumers and producers\ncreate bidirectional connectivity with each other (click to enlarge).\n\nFor an example configuration, see [Publish a hybrid service by using\nPrivate Service Connect](/load-balancing/docs/tcp/set-up-int-tcp-proxy-hybrid#publish).\n\nShared VPC\n----------\n\nPrivate Service Connect resources can be deployed in standalone\nVPC networks or Shared VPC\nnetworks. Private Service Connect endpoints, backends, and\nservice attachments can be deployed in host projects or service projects.\n\nFor example, a consumer service administrator can deploy\nPrivate Service Connect endpoints and backends in service\nprojects using IP addresses from subnets in the host project. With this\nconfiguration, the endpoints and backends can be reached from other service\nprojects in the same Shared VPC network.\n\nAll clients within a Shared VPC network have connectivity to a\nPrivate Service Connect endpoint regardless of which project it's\ndeployed in. However, the choice of project does affect visibility, IAM access,\nand which project the hourly resource billing is charged to.\n[](/static/vpc/images/psc-shared-vpc.svg) **Figure 7.** You can make Private Service Connect\nresources available in all service projects associated with a\nShared VPC network (click to enlarge).\n\nWhat's next\n-----------\n\n- Learn more about [Private Service Connect](/vpc/docs/private-service-connect).\n- View [Private Service Connect compatibility\n information](/vpc/docs/private-service-connect-compatibility)."]]
