Access global Google APIs through backends

Console

1. In the Google Cloud console, go to the Create a network endpoint group page.

   Go to Create a network endpoint group

2. On the Create network endpoint group page, enter a Name for the network endpoint group.

3. For the Network endpoint group type, select Private Service Connect NEG (Regional).

4. For Target, select Global Google APIs.

5. Select the Region for the network endpoint group.

6. Select the Target service for the network endpoint group.

7. Click Create.

gcloud

Use the network-endpoint-groups create command.

gcloud compute network-endpoint-groups create NEG_NAME \
    --network-endpoint-type=private-service-connect \
    --psc-target-service=TARGET_SERVICE \
    --region=REGION

Replace the following:

• NEG_NAME: a name for the network endpoint group.

• TARGET_SERVICE: the global Google API target that you want to connect to—for example, pubsub.googleapis.com. See the list of supported global Google API targets.

• REGION: the region to create the network endpoint group in.

API

Make a POST request to the regionNetworkEndpointGroups.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/networkEndpointGroups
{
  "name": "NEG_NAME",
  "networkEndpointType": "PRIVATE_SERVICE_CONNECT",
  "pscTargetService": "TARGET_SERVICE"
}

Replace the following:

• PROJECT_ID: the project ID of the network endpoint group.
• REGION: the region to create the network endpoint group in.
• NEG_NAME: a name for the network endpoint group.
• TARGET_SERVICE: the global Google API target that you want to connect to—for example, pubsub.googleapis.com. See the list of supported global Google API targets.

Console

Select the load balancer type

1. In the Google Cloud console, go to the Load balancing page.

   Go to Load balancing

2. Click Create load balancer.
3. For Type of load balancer, select Application Load Balancer (HTTP/HTTPS) and click Next.
4. For Public facing or internal, select Internal and click Next.
5. For Cross-region or single region deployment, select Best for cross-region workloads and click Next.
6. Click Configure.

Basic configuration

1. Enter a Name for the load balancer.

2. Select a Network for the load balancer.

   The network must contain a proxy-only subnet in the region where you are creating the load balancer.

Frontend configuration

1. Click Frontend configuration.
2. Enter a Name for the load balancer's forwarding rule.
3. In the Protocol field, select HTTPS (includes HTTP/2 and HTTP/3).
4. Select a Subnetwork region for the load balancer's subnetwork.
5. Select a Subnetwork for the load balancer.
6. Click IP address, and then do one of the following:
   • To automatically assign an ephemeral IP address, select Ephemeral (Automatic).
   • To choose an ephemeral IP address, select Ephemeral (Custom), and then enter a Custom ephemeral IP address from the IP address range of the load balancer's subnet.
   • To reserve and use a static internal IP address, click Create IP address, and then do the following:
     1. Enter a Name for the IP address.
     2. Click Static IP address, and then do one of the following:
        • To automatically assign a static IP address, select Assign automatically.
        • To configure a specific IP address, select Let me choose, and then enter a Custom IP address from the IP address range of the load balancer's subnet.
     3. Click Reserve.
7. Ensure that the Port field is set to 443, to allow HTTPS traffic.
8. Click the Certificate list, and then select your self-managed certificate.
9. Click Done.

Backend configuration

1. Click Backend configuration.

2. For each global Google API that you want to access, create a global backend service. To create a global backend service, do the following:

   1. From the Create or select backend services menu, select Create a backend service.
   2. Enter a Name for the backend service.
   3. Set the Backend type to Private Service Connect network endpoint group.
   4. Set the Private Service Connect target type to Global Google API.
   5. Select HTTPS for the protocol.

   6. In the Backends section, click the New backend menu, and select a Private Service Connect network endpoint group.

      If you need to create a new Private Service Connect network endpoint group, click Create PSC NEG.

   7. Click Done.

   8. Click Create.

3. Ensure that each backend service that you want to add is selected in the Create or select backend services menu, and then click OK.

Routing rules

The set of rules for routing incoming HTTPS requests to specific backend services is called a URL map. To learn more about URL maps, see URL maps overview.

If you are configuring only one backend service for the load balancer, the default routing rule is sufficient, and you can skip to Review and finalize.

If you are configuring multiple backend services, you must create one path matcher for each backend service. Each host rule can reference only one path matcher, but two or more host rules can reference the same path matcher.

1. If you have more than one backend service, click Routing rules.
2. Select Simple host and path rule.
3. For each backend, do the following:
   1. Click Add host and path rule.
   2. For Host, enter the hostname that will be used to send requests to this service—for example, pubsub.example.com.
   3. For Paths, enter the path—for example, /*.
   4. For Backends, select the backend service.

Review and finalize

1. Click Review and finalize to review the configuration.
2. Click Create.

gcloud