[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[],[],null,["# Private Service Connect deployment patterns\n===========================================\n\nThis page outlines some common ways to deploy and access\nPrivate Service Connect.\n\nSingle-tenant services\n----------------------\n\nSingle-tenant services are services that are dedicated to a single consumer or\ntenant. The service instance is typically hosted in a separate\nVPC network dedicated for that tenant to isolate it from other\ntenant VPC networks in the producer organization. Each service\nuses a [consumer accept\nlist](/vpc/docs/manage-private-service-connect-services#access) to control which\nprojects can connect to the service. Using the accept list, you can limit access\nto a single tenant. Although only a single tenant can connect to the service,\nthe tenant might create [multiple endpoints or backends](#multi-point) if they\nare connecting from multiple VPC networks.\n[](/static/vpc/images/psc-single-tenant.svg) **Figure 1.** In a single-tenant managed service, the producer deploys\na service in a separate VPC network that is dedicated to that\nconsumer (click to enlarge).\n\nMulti-tenant services\n---------------------\n\nMulti-tenant services are services that multiple consumers or tenants can\naccess. The producer configures the consumer accept list of the service so that\nconsumers in several or any projects can connect to the service. The consumer\naccept list also lets the producer control the number of\nPrivate Service Connect connections that each project can create.\nThese limits help the producer prevent resource or quota exhaustion. If the\nproducer needs to identify which tenant is the source of traffic, they can\nenable the [PROXY\nprotocol](/vpc/docs/about-vpc-hosted-services#proxy-protocol)\non the service.\n[](/static/vpc/images/psc-multi-tenant.svg) **Figure 2.** In a multi-tenant managed service, a service in one\nVPC network can be accessed by multiple consumers\n(click to enlarge).\n\nMulti-point access\n------------------\n\nMulti-point access is when multiple Private Service Connect\nendpoints or backends connect to the same service attachment. Multi-point\nPrivate Service Connect is useful for multi-tenant services\nbecause it allows multiple, independent consumers to connect to the same\nservice. It's also useful for single-tenant services for cases such as creating\nservice connectivity across multiple VPC networks within a single consumer.\n\nNot all services producers choose to support multi-point access in their managed\nservice. Contact your service producer to verify if their service attachments\nsupport multi-point access.\n\nMulti-region access\n-------------------\n\nMulti-region managed services are services that are deployed or accessed across\nmultiple regions. Clients might access services in a different region because\nthe service doesn't exist in their local region or for high availability and\nmulti-region failover. Because Google Cloud supports global\nVPC networks, [Private Service Connect global\naccess](/vpc/docs/about-accessing-vpc-hosted-services-endpoints#global-access)\nlets clients reach Private Service Connect endpoints from any\nregion. Client traffic can be from Compute Engine virtual machine (VM) instances,\nCloud VPN tunnels, and VLAN attachments for Cloud Interconnect.\n[](/static/vpc/images/psc-multi-region.svg) **Figure 3.** Private Service Connect endpoints with\nglobal access can be accessed from any region (click to enlarge).\n\nOn-premises and hybrid access\n-----------------------------\n\nYou can connect on-premises networks or other cloud providers to your\nVPC network by using VLAN attachments for\nCloud Interconnect and Cloud VPN tunnels. Because [endpoints\nfor Google APIs](/vpc/docs/about-accessing-google-apis-endpoints) and [endpoints\nfor published services](/vpc/docs/about-accessing-vpc-hosted-services-endpoints)\nare both globally accessible, clients in connected networks can send requests to\nendpoints in any region. However, you can deploy endpoints in multiple regions\nto more granularly control routing from hybrid networks. You can route hybrid\ntraffic from a specific region to a local endpoint which optimizes the shortest\nroute for the traffic path.\n[](/static/vpc/images/hybrid-access.svg) **Figure 4.** Private Service Connect endpoints and\nbackends can be accessed from connected networks (click to enlarge).\n\nBidirectional connectivity\n--------------------------\n\nAlthough consumer clients typically initiate connections to managed services,\nmanaged services sometimes need to initiate connections to consumer-owned\nservices.\n\n### Reverse private connectivity\n\n*Reverse private connectivity* is when a consumer lets VMs and\nGKE clusters in a producer VPC network\ninitiate traffic to a consumer VPC network by deploying\nPrivate Service Connect *in reverse*. In this case, the consumer\ndeploys an internal load balancer and service attachment, which publishes their\nservice to producers. Together, producers and consumers can use\nPrivate Service Connect in a forward and reverse direction\ntogether to create bidirectional connectivity with each other.\n[](/static/vpc/images/psc-reverse.svg) **Figure 5.** Reverse private connectivity lets consumers and producers\ncreate bidirectional connectivity with each other (click to enlarge).\n\n### Private Service Connect interfaces\n\n[Private Service Connect interfaces](/vpc/docs/about-private-service-connect-interfaces) create bidirectional,\ntransitive connections between consumer and producer VPC\nnetworks. Resources in both the consumer and producer\nVPC networks can initiate connections over the\nPrivate Service Connect interface. Additionally, because the\nconnection is transitive, resources in the producer VPC network\ncan communicate with [other workloads that are connected to the consumer\nVPC network](/vpc/docs/about-private-service-connect-interfaces#other-networks).\nFor example, a VM in the producer VPC\nnetwork can reach workloads in networks that are connected to the\nconsumer VPC network through Cloud Interconnect\nor VPC Network Peering.\n\nHybrid services\n---------------\n\nHybrid services that are not located in Google Cloud can be in other\nclouds, in an on-premises environment, or any combination of these locations.\nPrivate Service Connect lets you make a hybrid service accessible\nin another VPC network.\n\nHybrid services can be accessed through [hybrid\nNEGs](/load-balancing/docs/negs/hybrid-neg-concepts)\nwhich are compatible with [supported load\nbalancers](/vpc/docs/private-service-connect-compatibility#endpoints-services).\n\nOften this configuration is used as a form of reverse private connectivity, with\nservice producers making connections to consumer services that are hosted in\non-premises networks. Private Service Connect lets the producer\nreach the consumer hybrid networks without establishing connectivity directly\nwith those networks.\n[](/static/vpc/images/psc-hybrid.svg) **Figure 6.** Reverse private connectivity lets consumers and producers\ncreate bidirectional connectivity with each other (click to enlarge).\n\nFor an example configuration, see [Publish a hybrid service by using\nPrivate Service Connect](/load-balancing/docs/tcp/set-up-int-tcp-proxy-hybrid#publish).\n\nShared VPC\n----------\n\nPrivate Service Connect resources can be deployed in standalone\nVPC networks or Shared VPC\nnetworks. Private Service Connect endpoints, backends, and\nservice attachments can be deployed in host projects or service projects.\n\nFor example, a consumer service administrator can deploy\nPrivate Service Connect endpoints and backends in service\nprojects using IP addresses from subnets in the host project. With this\nconfiguration, the endpoints and backends can be reached from other service\nprojects in the same Shared VPC network.\n\nAll clients within a Shared VPC network have connectivity to a\nPrivate Service Connect endpoint regardless of which project it's\ndeployed in. However, the choice of project does affect visibility, IAM access,\nand which project the hourly resource billing is charged to.\n[](/static/vpc/images/psc-shared-vpc.svg) **Figure 7.** You can make Private Service Connect\nresources available in all service projects associated with a\nShared VPC network (click to enlarge).\n\nWhat's next\n-----------\n\n- Learn more about [Private Service Connect](/vpc/docs/private-service-connect).\n- View [Private Service Connect compatibility\n information](/vpc/docs/private-service-connect-compatibility)."]]
