Make the service accessible from other VPC networks

This tutorial shows you how to make a load-balanced service available from other VPC networks by using Private Service Connect.

By default, the internal passthrough Network Load Balancer that you created in the previous tutorial is available only within its own VPC network. With Private Service Connect, you can publish the service to make it available to resources in other VPC networks.

This tutorial is intended for cloud architects, network architects, network administrators, and IT administrators.

Objectives

  • Create the published service
  • Create a firewall rule for published service traffic
  • Get the service attachment URI

Costs

In this document, you use the following billable components of Google Cloud:

To generate a cost estimate based on your projected usage, use the pricing calculator.

New Google Cloud users might be eligible for a free trial.

When you finish the tasks that are described in this document, you can avoid continued billing by deleting the resources that you created. For more information, see Clean up.

Before you begin

  1. Complete the steps in the previous tutorial, Create a load-balanced service.
  2. Select the service producer project (PRODUCER_PROJECT) that you selected or created in the previous tutorial. Use this project for the steps in this tutorial.

Create the published service

To make the service available from other VPC networks, you publish the service. To publish a service, create the following resources in the same network and region as the load balancer:

  • A Private Service Connect subnet that provides IP addresses for network address translation (NAT) between the producer and consumer networks.
  • A service attachment.

These instructions create a published service that is accessible from any project. In a production environment, you might instead choose to limit which networks or projects can access the service.

Console

  1. In the Google Cloud console, go to the Private Service Connect page.

    Go to Private Service Connect

  2. Click the Published services tab.

  3. Click Publish service.

  4. In the Target details section, select Load balancer.

  5. Select Internal passthrough Network Load Balancer

  6. Select the internal load balancer that you created, service-lb.

  7. For Service name, enter published-service.

  8. Create a Private Service Connect subnet for NAT:

    1. Click Subnets, and then click Reserve new subnet.
    2. For Name, enter nat-subnet.
    3. For Region, select REGION.