Create and manage Private Service Connect interfaces

This page describes how producer network administrators can create and manage Private Service Connect interfaces. Private Service Connect interfaces let service producer Virtual Private Cloud (VPC) networks initiate connections to consumer VPC networks.

Before you begin

You must enable the Compute Engine API in your project.
Find the URL of the network attachment that you want to connect to.
If the network attachment is configured to manually accept connections, ensure that a network administrator has added your project to the network attachment's accept list.

Roles

To get the permissions that you need to create Private Service Connect interfaces, ask your administrator to grant you the following IAM roles on your project:

Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1)
Compute Network Admin (roles/compute.networkAdmin)

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

The Compute Instance Admin (v1) role contains the compute.instances.pscInterfaceCreate permission, which is required to create Private Service Connect interfaces.

Create VMs with Private Service Connect interfaces

To create a Private Service Connect interface connection, you need a virtual machine (VM) instance that has at least two network interfaces. The first interface connects to a producer subnet. The other interfaces can be Private Service Connect interfaces that request connections to network attachments in different consumer VPC networks.

If a connection is accepted, Google Cloud assigns to the Private Service Connect interface an internal IP address from the subnet that is specified by the network attachment.

When you create a VM with multiple Private Service Connect interfaces, each interface must connect to:

A different network attachment that is associated with a different subnet.
A network attachment that is in a different VPC network, unless both of the following are true:
- The consumer network uses an RDMA network profile for Falcon VPC networks.
- The producer connects with virtual Private Service Connect interfaces.

If you create a Private Service Connect interface that refers to a network attachment that's configured to manually accept connections, the following applies:

If the network attachment is configured to accept connections based on project ID, your project ID must be included in the consumer accept list.
If the network attachment is configured to accept connections based on service class ID, only authorized Google services can connect to it.

If these requirements aren't met, creation of the Private Service Connect interface's VM fails. Work with the consumer organization to add your project ID to the network attachment's accept list or to provide a network attachment that uses project-based authorization. After the authorization is corrected, create a new Private Service Connect interface.

When you create a Private Service Connect interface, you can optionally assign to it one or more internal alias IP ranges. If you plan to assign alias IP ranges, contact the consumer organization to determine the appropriate IP address ranges.

To assign an alias IP range, specify the prefix length of the range in CIDR notation. When you assign one or more alias IP ranges to a Private Service Connect interface, Google Cloud allocates the alias IP ranges from the primary IP address range of the subnet that's associated with the network attachment. The Private Service Connect interface's primary IP address is allocated from outside of any alias IP ranges. If there aren't enough IP addresses in the network attachment's subnet to allocate the primary IP address and alias IP ranges, creation of the Private Service Connect interface's VM fails. You can find the specific IP addresses that are assigned by describing the interface's VM.

Console

Create a VM instance

In the Google Cloud console, go to the VM instances page:

Go to VM instances
Click Create instance.
In the Name box, enter a name.
Click Region, and then select the region of the network attachment that you want to connect to.
Select a zone.
To configure the VM's default network interface, do the following:
1. Click Networking.
2. In the Network interfaces section, click the first network interface, which is the default network interface.
3. Select a network.
4. Select a subnet that is in the same region as the Private Service Connect interface's network attachment.
5. Select an IP stack type.
Click Done.

Add Private Service Connect interfaces

You can repeat these steps for each interface that you want to add.

Add a virtual Private Service Connect interface

Click Add a network interface.
For Interface type, select Private Service Connect.
In the Network attachment URL box, enter the URL of this interface's network attachment.
Select an IP stack type for the interface. The network attachment's subnet determines the possible stack types.
Optional: To add an alias IP range, do the following:
1. In the Alias IP ranges section, click Add IP range.
2. In the Prefix length box, enter the prefix length—for example, /30. You can add multiple alias IP ranges by clicking Add IP range, and then entering the prefix length for each additional alias IP range that you want to add.
Click Done.

Add a dynamic Private Service Connect interface

Click Add a dynamic network interface.
For Interface type, select Private Service Connect.
Select a parent network interface.
In the VLAN ID box, enter a VLAN ID.
In the Network attachment URL box, enter the URL of this interface's network attachment.
Select an IP stack type for the interface. The network attachment's subnet determines the possible stack types.
Optional: To add an alias IP range, do the following:
1. In the Alias IP ranges section, click Add IP range.
2. In the Prefix length box, enter the prefix length—for example, /30. You can add multiple alias IP ranges by clicking Add IP range, and then entering the prefix length for each additional alias IP range that you want to add.
Click Done.

To create the VM, click Create.

gcloud

To create a VM with a virtual Private Service Connect interface, use the gcloud compute instances create command.
```
gcloud compute instances create INSTANCE_NAME \
    --zone=ZONE \
    --machine-type=MACHINE_TYPE \
    --image-project=IMAGE_PROJECT \
    --image-family=IMAGE_FAMILY \
    --network-interface='subnet=PRODUCER_SUBNET,no-address' \
    --network-interface='network-attachment=ATTACHMENT_URI,stack-type=STACK_TYPE'
```
Replace the following:
- INSTANCE_NAME: the name of the new instance
- ZONE: the zone of the new instance
- MACHINE_TYPE: the instance's machine type, which can be predefined or custom—for example, n1-standard-1
- IMAGE_PROJECT: the project of the image family
  
  For example, if you specify debian-12 as the image family, specify debian-cloud as the image project. You can view a list of available images, image projects, and image families by using the gcloud compute images list command.
- IMAGE_FAMILY: the image family of the instance
  
  This creates the VM with the most recent, non-deprecated OS image in the image family. For example, if you specify debian-12, Compute Engine uses the latest version of the OS image in the Debian 12 image family.
- PRODUCER_SUBNET: the subnet of the VM's primary network interface
  
  This subnet must be in the same region as the Private Service Connect interface's network attachment.
- ATTACHMENT_URI: the URI of the network attachment—for example: projects/CONSUMER_PROJECT_ID/regions/REGION/networkAttachments/ATTACHMENT_NAME
- STACK_TYPE: the stack type of the Private Service Connect interface
  
  To create an interface with an IPv4 address, specify IPV4_ONLY (the default). To create an interface that uses both an IPv4 and an IPv6 address (dual-stack), specify IPV4_IPV6. For IPv6 only, specify IPV6_ONLY.
  
  The interface's stack type must be compatible with the stack type of the network attachment's subnet.
To create a VM with a dynamic Private Service Connect interface, use the following command:
```
gcloud compute instances create INSTANCE_NAME \
    --zone=ZONE \
    --machine-type=MACHINE_TYPE \
    --image-project=IMAGE_PROJECT \
    --image-family=IMAGE_FAMILY \
    --network-interface='subnet=PRODUCER_SUBNET,no-address' \
    --network-interface='network-attachment=ATTACHMENT_URI,vlan=VLAN_ID,stack-type=STACK_TYPE'
```
Replace VLAN_ID with the VLAN ID of the dynamic Private Service Connect interface, which must be an integer from 2 to 255.

VLAN IDs must be unique for each dynamic interface that shares a parent vNIC. You can reuse the same ID for other dynamic interfaces that are associated with different vNICs.
To assign alias IP ranges to a Private Service Connect interface, use the following command:
```
gcloud compute instances create INSTANCE_NAME \
    --zone=ZONE \
    --machine-type=MACHINE_TYPE \
    --image-project=IMAGE_PROJECT \
    --image-family=IMAGE_FAMILY \
    --network-interface='subnet=PRODUCER_SUBNET,no-address' \
    --network-interface='network-attachment=ATTACHMENT_URI,vlan=VLAN_ID,stack-type=STACK_TYPE,aliases=ALIAS_IP_RANGES'
```
Replace ALIAS_IP_RANGES with one or more alias IP ranges to assign to the interface. You can enter specific ranges (192.168.100.0/24), specific IP addresses (192.168.100.1), or prefix lengths in CIDR format (/24). You can enter multiple values in a semicolon-separated list. You can't enter multiple values of different types. For example, 192.168.100.0/24;/28 isn't supported.
To create a VM with multiple Private Service Connect interfaces, include separate --network-interface flags for each interface, where each flag refers to a different network attachment.

For dynamic Private Service Connect interfaces, the parent vNIC is determined by the order of flags in the command. The parent vNIC is the first vNIC that you specify before the dynamic interface.

You can create dynamic and virtual Private Service Connect interfaces that coexist on the same VM. For example, the following command creates a VM with both virtual and dynamic Private Service Connect interfaces.

The parent of the dynamic Private Service Connect interfaces that have VLAN IDs 2 and 3 is the first vNIC, connecting to producer-subnet. The parent of the dynamic interface that has VLAN ID 4 is the vNIC that connects to producer-subnet-2. The last interface is a virtual Private Service Connect interface.
```
gcloud compute instances create producer-vm \
    --zone=us-west-1a \
    --network-interface='subnet=producer-subnet,no-address' \
    --network-interface='network-attachment=projects/consumer-project/regions/us-west-1/networkAttachments/consumer-1-network-attachment,vlan=2' \
    --network-interface='network-attachment=projects/consumer-project/regions/us-west-1/networkAttachments/consumer-2-network-attachment,vlan=3' \
    --network-interface='network=producer-vpc-2,subnet=producer-subnet-2' \
    --network-interface='network-attachment=projects/consumer-project/regions/us-west-1/networkAttachments/consumer-3-network-attachment,vlan=4' \
    --network-interface='network-attachment=projects/consumer-project/regions/us-west-1/networkAttachments/consumer-4-network-attachment'
```

API

To create a VM with a virtual Private Service Connect interface, send a request to the instances.insert method.

HTTP method and URL:
```
POST https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/zones/INSTANCE_ZONE/instances
```
Request JSON body:
```
{
  "machineType": "zones/MACHINE_TYPE_ZONE/machineTypes/MACHINE_TYPE",
  "name": "VM_NAME",
  "disks": [
    {
      "initializeParams": {
        "sourceImage": "projects/IMAGE_PROJECT/global/images/family/IMAGE_FAMILY"
      },
      "boot": true
    }
  ],
  "networkInterfaces": [
    {
      "network": "https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/global/networks/PRODUCER_NETWORK",
      "subnetwork": "https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/regions/SUBNET_REGION/subnetworks/PRODUCER_SUBNET"
    },
    {
      "networkAttachment": "ATTACHMENT_URI",
      "stackType": "STACK_TYPE"
    }
  ]
}
```
Replace the following:
- PRODUCER_PROJECT_ID: the ID of the VM's project
- INSTANCE_ZONE: the zone of the new instance
- MACHINE_TYPE_ZONE: the zone of the machine type
- MACHINE_TYPE: the instance's machine type, which can be predefined or custom—for example, n1-standard-1
- VM_NAME: the name of the VM instance
- IMAGE_PROJECT: the project of the image family
  
  For example, if you specify debian-12 as the image family, specify debian-cloud as the image project. You can view a list of available images, image projects, and image families by using the gcloud compute images list command.
- IMAGE_FAMILY: the image family of the instance
  
  This creates the VM with the most recent, non-deprecated OS image in the image family. For example, if you specify debian-12, Compute Engine uses the latest version of the OS image in the Debian 12 image family.
- PRODUCER_NETWORK: the network of the VM's primary network interface
- SUBNET_REGION: the region of the subnet of the VM's primary network interface
- PRODUCER_SUBNET: the subnet of the VM's primary network interface
  
  This subnet must be in the same region as the Private Service Connect interface's network attachment.
- ATTACHMENT_URI: the URI of the network attachment—for example: projects/CONSUMER_PROJECT_ID/regions/REGION/networkAttachments/ATTACHMENT_NAME
- STACK_TYPE: the stack type of the Private Service Connect interface.
  
  To create an interface with an IPv4 address, specify IPV4_ONLY (the default). To create an interface that uses both an IPv4 and an IPv6 address (dual-stack), specify IPV4_IPV6. For IPv6 only, specify IPV6_ONLY.
  
  The interface's stack type must be compatible with the stack type of the network attachment's subnet.

To create a VM with a dynamic Private Service Connect interface, send the following request. Include a VLAN ID in the network interface object to specify the creation of a dynamic Private Service Connect interface.

HTTP method and URL:

POST https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/zones/INSTANCE_ZONE/instances

Request JSON body:

{
  "machineType": "zones/MACHINE_TYPE_ZONE/machineTypes/MACHINE_TYPE",
  "name": "VM_NAME",
  "disks": [
    {
      "initializeParams": {
        "sourceImage": "projects/IMAGE_PROJECT/global/images/family/IMAGE_FAMILY"
      },
      "boot": true
    }
  ],
  "networkInterfaces": [
    {
      "network": "https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/global/networks/PRODUCER_NETWORK",
      "subnetwork": "https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/regions/SUBNET_REGION/subnetworks/PRODUCER_SUBNET"
    },
    {
      "networkAttachment": "ATTACHMENT_URI",
      "vlan": VLAN_ID,
      "stackType": "IPV4_IPV6"
    }
  ]
}

Replace VLAN_ID with the VLAN ID of the dynamic Private Service Connect interface, which must be an integer from 2 to 255.

VLAN IDs must be unique for each dynamic interface that shares a parent vNIC. You can reuse the same ID for other dynamic interfaces that are associated with different vNICs.

To assign alias IP ranges to a Private Service Connect interface, send the following request. Include the aliasesIpRanges field.

HTTP method and URL:

POST https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/zones/INSTANCE_ZONE/instances

Request JSON body:

{
  "machineType": "zones/MACHINE_TYPE_ZONE/machineTypes/MACHINE_TYPE",
  "name": "VM_NAME",
  "disks": [
    {
      "initializeParams": {
        "sourceImage": "projects/IMAGE_PROJECT/global/images/IMAGE"
      },
      "boot": true
    }
  ],
  "networkInterfaces": [
    {
      "network": "https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/global/networks/PRODUCER_NETWORK",
      "subnetwork": "https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/regions/SUBNET_REGION/subnetworks/PRODUCER_SUBNET"
    },
    {
      "aliasIpRanges": [
        {
          "ipCidrRange": "ALIAS_IP_RANGE"
        }
      ],
      "networkAttachment": "ATTACHMENT_URI"
    }
  ]
}

Replace ALIAS_IP_RANGE with an alias IP ranges to assign to the interface. You can enter a specific range (