VPC release notes

Preview: You can create v2 IPv4 public advertised prefixes for bring your own IP addresses (BYOIP) that use Standard Tier IP addresses. For more information, see Network Service Tiers.

General Availability: You can use the Resolve subnet mask setting on a subnet to configure all attached Compute Engine instances with the same netmask as the subnet (instead of /32). Configuring larger instance netmasks lets compute instances discover the MAC addresses of other machines within the same subnet and directly communicate with them by using destination MAC addresses.

For more information, see Compute instance netmasks.

For Google Cloud resources that are registered as App Hub workloads or services, VPC Flow Logs records contain application-specific labels. For more information, see App Hub labels.

Preview: You can reserve static external IPv6 addresses from bring your own IP addresses (BYOIP) sub-prefixes that are in EXTERNAL_IPV6_FORWARDING_RULE_CREATION mode.

You can assign these addresses to forwarding rules for external passthrough Network Load Balancers and external protocol forwarding. You can also promote ephemeral IPv6 BYOIP addresses that are used by external forwarding rules to reserved static IP addresses.

For more information, see Create external forwarding rules.

General Availability: If a consumer VPC network uses an RDMA network profile for Falcon VPC networks, a single Compute Engine instance can connect to it by using multiple virtual Private Service Connect interfaces.

For more information, see Create VMs with Private Service Connect interfaces.

General Availability: You can cancel pending deletion requests for VPC Network Peering connections that are in consensus mode. For more information, see Cancel a deletion request.

General Availability: Service consumers can authorize Private Service Connect interfaces to connect to network attachments by adding service class IDs to a network attachment's accept list.

For more information, see Authorization policies.

Preview: RoCE VPC networks for VM instances support assigning alias IP ranges to MRDMA vNICs. For more information about these features, see the following:

• RDMA network profiles
• Alias IP ranges

General Availability: Composite Health for Private Service Connect, formerly known as Private Service Connect health, lets service producers define health criteria for published services, enabling automatic cross-region failover for consumers that access the service by using Private Service Connect backends.

You can cancel pending deletion requests for VPC Network Peering connections that are in consensus mode. This feature is available in Preview. For more information, see Cancel a deletion request.

Organization Policy Service custom constraints are available in General Availability for private services access connections. For more information, see Restrict private connections with organization policies.

Private Service Connect consumers can configure supported load balancers or regional Cloud Service Mesh to access published services through Private Service Connect endpoints. This feature is available in Preview.

For more information, see Published service backends.

Hybrid Subnets is available in General Availability. Hybrid subnet routing lets a VPC network share a CIDR block with a connected on-premises network. This configuration helps you migrate workloads to Google Cloud without needing to change any IP addresses. During migration, workloads that have migrated to your VPC network can communicate with those remaining in the on-premises network by using internal IP addresses. After all workloads have migrated, you can disable hybrid subnet routing to restore normal routing behavior.

For information about pricing for Hybrid Subnets, see Virtual Private Cloud pricing.

Service producers can accept or reject connections from individual Private Service Connect endpoints. This feature is available in General Availability.

You can update a service attachment's target service without recreating the service attachment. Consumer connections are preserved during the update, but traffic is briefly disrupted. This feature is available in General Availability.

For more information, including a list of supported configurations, see Service mutability.

You can create Compute Engine instances that have multiple network interfaces in the same VPC network. This feature is available in Preview. For more information, see Multiple network interfaces in the same VPC network.

You can create a VPC network that supports RDMA over Falcon transport, which lets you run AI and high performance computing (HPC) workloads on Compute Engine instances that have the IRDMA network interface type in Google Cloud, such as H4D instances. This feature is available in General Availability.

For more information, see RDMA network profiles.

You can use constraints in custom organization policies to provide more granular and customizable control over specific fields for internal ranges. For more information, see Manage VPC resources by using custom organization policies.

You can bring your own IPv6 global unicast addresses (GUAs) to assign to a subnet's internal IPv6 address range. Although GUAs are typically public addresses, in this configuration they are used privately and function in the same way as Google Cloud-provisioned ULAs.

For more information, see Bring your own IP addresses.

You can create individual static external IPv4 addresses from bring your own IP addresses (BYOIP) prefixes. This feature is available in General Availability and only applies to IPv4 regional v2 prefixes that are created after December 13, 2025.

For more information, see Enhanced IP address allocation.

For auto mode VPC networks, added a new subnet 10.232.0.0/20 for the Bangkok asia-southeast3 region. For more information, see Global locations and Auto mode IP ranges.

Dynamic Private Service Connect interfaces are available in General Availability. Private Service Connect interfaces let service producers initiate connections to service consumers. You can update a VM instance to add or remove dynamic Private Service Connect interfaces without needing to restart or recreate the instance.

For more information, see Private Service Connect interface types.

Service producers can accept or reject connections from individual Private Service Connect endpoints. This feature is available in Preview.

VPC Network Peering supports peering connections in consensus mode. This feature is available in General Availability. For more information, see Connection mode.

Dynamic Network Interfaces (NICs) are available in General Availability.

Dynamic NICs let you update an instance to add or remove network interfaces without having to restart or recreate the instance.

You can also use Dynamic NICs when you need more network interfaces. The maximum number of vNICs for most machine types in Google Cloud is 10; however, you can configure up to 16 total interfaces by using Dynamic NICs.

For more information, see the following:

• Dynamic NICs
• Create a VM instance with Dynamic NICs
• Add Dynamic NICs to an existing instance

You can specify a /96 IPv6 address range when reserving static regional IPv6 addresses. For more information, see the following:

• Reserve a static internal IP address
• Reserve a static external IP address

This feature is available in General Availability.

You can view IP address utilization when you list or describe subnets. IP address utilization displays the number of free and allocated IP addresses in a subnet. This feature is available in General Availability.

VPC Flow Logs supports logging for Cloud Run resources that are configured with Direct VPC egress. This feature is available in General Availability.

For more information, see Serverless flows and ServerlessDetails field format.

Private Service Connect health is available in Preview.

Private Service Connect health lets service producers define health states to support automatic cross-region failover for consumers that use Private Service Connect backends. For more information, see About Private Service Connect health for automatic cross-region failover.

The following features of VPC Flow Logs are available in General Availability:

• Logging for RDMA over Falcon transport
• Enhanced round-trip time precision for TCP and Falcon traffic

For more information, see About VPC Flow Logs records.

The following features of VPC Flow Logs are available in General Availability through the Network Management API:

• Enabling VPC Flow Logs for an organization
• Enabling VPC Flow Logs for a VPC network
• Enabling VPC Flow Logs for a subnet

For more information, see Supported configurations.

Service producers can publish services that are hosted on cross-region internal Application Load Balancers. This feature is available in General Availability. For more information, see Publish services by using Private Service Connect.

You can create a VPC network that supports RDMA over Falcon transport, which lets you run AI and high performance computing (HPC) workloads on VM instances that have the IRDMA network interface type in Google Cloud, such as H4D instances. This feature is available in Preview. For more information, see RDMA network profiles.

IPv6-only subnets and instances are available in General Availability. For more information, see the following:

• Add an IPv6-only subnet
• Create an IPv6-only instance
• Configure IPv6-only subnets and instances with DNS64 and NAT64

You can also use an IPv6-only NAT subnet to publish a service with Private Service Connect.

For information about which services support IPv6-only configurations, see IPv6 support in Google Cloud.

VPC Flow Logs supports logging for RDMA flows over Converged Ethernet, such as GPU-to-GPU flows from A3 Ultra, A4, and A4X VMs. This feature is available in General Availability. For more information, see About VPC Flow Logs records.

VPC Flow Logs includes metadata annotations for Google services such as Google APIs and VPC-hosted services. The following annotations are available in General Availability:

• service_name
• connectivity
• private_domain

These annotations are supported for flows between VMs in VPC networks and Google services and for flows between on-premises endpoints and Google services (through Cloud Interconnect and Cloud VPN). For more information, see GoogleServiceDetails field format.

When you reserve an internal range with an automatically allocated IPv4 CIDR block, you can specify the allocation strategy that is used to select a free block. This feature is available in General Availability.

Dynamic Private Service Connect interfaces are available in Preview. You can update VM instances to add or remove dynamic Private Service Connect interfaces without restarting or recreating the instance.

For more information, see Private Service Connect interface types.

VPC Network Peering supports peering connections in consensus mode. This feature is available in Preview. For more information, see Connection mode.

The following features of policy-based routes are available in General Availability:

• Applying policy-based routes to IPv6 traffic
• Using a next hop that is in a peered VPC network

For more information, see Create policy-based routes.

Private Service Connect service connectivity automation periodically retries endpoint create or delete operations that fail due to errors. This feature is available in General Availability. For more information, see Automatic retries for endpoint failures.

The following features of VPC Flow Logs are available in Preview through the Network Management API:

• Enabling VPC Flow Logs for an organization
• Enabling VPC Flow Logs for a VPC network
• Enabling VPC Flow Logs for a subnet

For more information, see Supported configurations.

VPC Flow Logs annotates RDMA traffic that is reported from A3 Mega VMs. This feature is available in General Availability. For more information, see About VPC Flow Logs records.

Dynamic Network Interfaces (NICs) are available in Preview.

Dynamic NICs let you update an instance to add or remove network interfaces without having to restart or recreate the instance.

You can also use Dynamic NICs when you need more network interfaces. The maximum number of vNICs for most machine types in Google Cloud is 10; however, you can configure up to 16 total interfaces by using Dynamic NICs.

For more information, see the following:

• Dynamic NICs
• Create a VM instance with Dynamic NICs
• Add Dynamic NICs to an existing instance

You can publish a Secure Web Proxy instance as a Private Service Connect service. Making Secure Web Proxy available as a published service lets you centralize egress traffic management across multiple VPC networks. This feature is available in General Availability.

You can assign IPv6 bring your own IP (BYOIP) addresses to a subnet's external address range. These subnet ranges can only be used by VM instances, either as ephemeral or reserved addresses. To reserve addresses from these ranges, create a static regional external IPv6 address with the VM endpoint type. This feature is available in General Availability.

For more information, see Create and use IPv6 sub-prefixes.

Service producers can publish services that are hosted on cross-region internal Application Load Balancers. This feature is available in Preview. For more information, see Publish services by using Private Service Connect.

You can exclude IP address ranges from being used for automatic IP address allocation for internal ranges. This feature is available in General Availability. For more information, see Reserve internal ranges.

The following features of internal ranges are available in General Availability:

• Reserving internal ranges with IPv6 addresses
• Creating immutable ranges (ranges that can't be edited, except for the description)
• Editable descriptions

For more information, see Internal ranges overview.

When you reserve an internal range with an automatically allocated IPv4 CIDR block, you can specify the allocation strategy that is used to select a free block. This feature is available in Preview.

If you're a service producer that makes a service available through VPC Network Peering, you can migrate your service to Private Service Connect without changing the IPv4 address that consumers use to access the service. This feature is available in General Availability.

When you create a Private Service Connect endpoint to connect to a regional endpoint of a supported service, you can use the public hostname in your configuration—for example, spanner.me-central2.rep.googleapis.com.

You can access global Google APIs by using Private Service Connect backends that are based on cross-region internal Application Load Balancers. This feature is available in General Availability. For more information, see Access global Google APIs through backends.

Support for the following is available in General availability for dual-stack configurations:

• IPv6 static routes with a next hop internal passthrough Network Load Balancer (next-hop-ilb)
• IPv6 static routes with a next hop instance identified by address (next-hop-address)

For more information, see Next hops and features in the static routes overview.

The following features of internal ranges are available in Preview:

• Reserving internal ranges with IPv6 addresses
• Creating immutable internal ranges (ranges that can't be updated, except for the description)
• Editable descriptions

For more information, see Internal ranges overview.

You can exclude IP address ranges from internal range automatic IP address allocation. This feature is available in Preview. For more information, see Reserve internal ranges.

You can create internal ranges that overlap with routes and subnets. This feature is available in General Availability. For more information, see Internal ranges overview.

For auto mode VPC networks, added a new subnet 10.226.0.0/20 for the Stockholm europe-north2 region. For more information, see Global Locations and Auto mode IP ranges.

Accessing supported global Google APIs through Private Service Connect backends is available in General Availability.

The following Private Service Connect monitoring metrics are available for both producers and consumers in General Availability:

• Closed connections count
• Received packets dropped count
• Sent packets dropped count
• New connections count
• Open connections
• Received bytes count
• Received packets count
• Sent bytes count
• Sent packets count

Additionally, the NAT IP address capacity metric is available for producers in General Availability.

You can use these metrics to help monitor and troubleshoot published services, endpoints that connect to published services, and backends that connect to published services. For more information, see Monitor Private Service Connect connections.

Private Service Connect propagated connections are available in General Availability. With propagated connections, services that are accessible in one consumer VPC spoke through Private Service Connect endpoints can be privately accessed by other consumer VPC spokes that are connected to the same Network Connectivity Center hub.

Private Service Connect service connectivity automation supports IPv6 connectivity to eligible managed services. This feature is available in General availability. For more information, see Endpoint IP versions.

There is a known issue with global access endpoints that access services that are published by using internal passthrough Network Load Balancers or internal protocol forwarding (target instances). Private Service Connect doesn't validate that the global access setting on the endpoint matches the setting on the producer's load balancer. We recommend the following:

• If you're a service consumer, only enable global access on an endpoint if you know that the producer's load balancer is configured for global access. For more information, see endpoint Known issues.

• If you're a service producer whose services are hosted on internal passthrough Network Load Balancers or internal protocol forwarding (target instances), and those services are accessed through global access endpoints, ensure that global access is enabled on your services' load balancers. For more information, see published services Known issues.

VPC Flow Logs metadata annotations include InstanceGroupDetails. This feature is available in General Availability.

Private Service Connect endpoints for regional Google APIs can be configured with IPv6 addresses to support access from IPv6 clients. This feature is available in General Availability.

You can create an internal range with the usage type FOR_MIGRATION to migrate a CIDR range from one subnet to another. For more information, see Migrating subnet ranges. This feature is available in General Availability.

The network profile resource and an RDMA network profile are available in General Availability. You can create a VPC network with the RDMA network profile, which lets you run AI workloads on VM instances that have RDMA network interfaces (NICs). For more information, see the following:

• Network profiles overview
• RDMA network profile

If you're a service producer that makes a service available through VPC Network Peering, you can migrate your service to Private Service Connect without changing the IP address that consumers use to access the service. This feature is available in Preview.

If you create a Private Service Connect backend to connect to a published service, and the producer has let you know which port the service is available on, you can include the producer port in the backend configuration.

For more information about the producer's configuration, see Producer port configuration.

Specifying the producer port in a Private Service Connect backend is available in General Availability.

VPC Flow Logs can sample traffic that is sent through VLAN attachments for Cloud Interconnect and Cloud VPN tunnels. This feature is available in General Availability. To enable VPC Flow Logs for VLAN attachments and Cloud VPN tunnels, see Configure VPC Flow Logs.

IPv6-only subnets and instances are available in Preview. For more information, see the following:

• Add an IPv6-only subnet
• Create an IPv6-only instance
• Types of subnets

For information about which services support IPv6-only configurations, see IPv6 support in Google Cloud.

Private Service Connect service connectivity automation lets you automate connectivity to supported Google service instances that are located in a different project, folder, or organization than the service consumer (custom scope). This feature is available in General Availability.

Private Service Connect port mapping is available in General Availability. Port mapping lets consumer virtual machine (VM) instances privately communicate with specific service ports on specific producer VMs through a single Private Service Connect endpoint.

For auto mode VPC networks, added a new subnet 10.224.0.0/20 for the Mexico northamerica-south1 region. For more information, see Global Locations and Auto mode IP ranges.

Support for IPv6 static routes with a next hop internal passthrough Network Load Balancer (next-hop-ilb) is available in Preview.

Private Service Connect supports IPv6 in General Availability for the following supported configurations:

• Service consumers can access published services by using Private Service Connect endpoints that have IPv6 addresses.
• Service producers that use supported load balancers can publish services by using service attachments that have IPv6 addresses.

For more information, see IP version translation.

You can use Private Service Connect endpoints to access the regional service endpoints of supported Google APIs. This feature is available in General Availability.

VPC Flow Logs can sample traffic that is sent through VLAN attachments for Cloud Interconnect and Cloud VPN tunnels. This feature is available in Preview. For more information, see VPC Flow Logs.

The live migration feature for bring your own IP v1 has been removed. For new configurations, we recommend that you use bring your own IP v2, which lets you control when prefixes are advertised.

VPC Flow Logs includes the following metadata annotations in General Availability:

• src_gateway and dest_gateway
• src_google_service and dest_google_service
• load_balancing
• network_service
• psc

For more information, see Record Format.

The following producer load balancers now support all Private Service Connect monitoring metrics:

• Regional internal Application Load Balancer
• Regional internal proxy Network Load Balancer

Predefined dashboards for monitoring Private Service Connect connections have been enhanced:

• The dashboard for monitoring published services now includes more metrics.
• A new dashboard is available for monitoring endpoints that connect to published services.

In the Google Cloud Console, the Effective routes tab on the Routes page shows only routes that are effective. You can optionally show suppressed routes by using the Show suppressed routes toggle. You can also view the reason why a given route is suppressed. For more information, see List routes for a VPC network.

Private Service Connect backends can be used to reach regional endpoints for supported Google APIs. Regional endpoints replace locational endpoints for Private Service Connect backends.

The list of supported regional endpoints that can be accessed by Private Service Connect endpoints and backends is updated to include additional supported Google APIs and regions.

Bring your own IP does not support creating BYOIP addresses in Shared VPC service projects. This limitation is documented, but was previously not enforced. Enforcement has been added to prevent the creation of BYOIP addresses in service projects. If you're using bring your own IP with Shared VPC, use the project architecture described in BYOIP addresses administration with Shared VPC.

Private Service Connect backends support using a cross-regional internal Application Load Balancer to access global Google API targets. This feature is available in Preview.

Private Service Connect port mapping is available in Preview. Port mapping lets consumer virtual machine (VM) instances privately communicate with specific service ports on specific producer VMs through a single Private Service Connect endpoint.

Private Service Connect propagated connections are available in Preview. With propagated connections, services that are accessible in one consumer VPC spoke through Private Service Connect endpoints can be privately accessed by other consumer VPC spokes that are connected to the same Network Connectivity Center hub.

VPC Flow Logs includes internet routing details for egress flows. For more information, see InternetRoutingDetails field format. This field is available in General Availability.

The following features of policy-based routes are available in Preview:

• Applying policy-based routes to IPv6 traffic
• Using a next hop that is in a peered VPC network

For more information, see Create policy-based routes.

Bring your own IP lets you bring your own public IPv6 addresses to Google Cloud. IPv6 BYOIP addresses can be used with external passthrough Network Load Balancers. Bring your own IP for IPv6 addresses is available in General Availability.

Support for IPv6 static routes with a next hop instance identified by address (next-hop-address) is available in Preview.

Private Service Connect supports IPv6 in Preview for the following supported configurations:

• Service consumers can access published services by using Private Service Connect endpoints that have IPv6 addresses.
• Service producers that use supported load balancers can publish services by using service attachments that have IPv6 addresses.

For more information, see IP version translation.

Private Service Connect now offers consumers volume-based discounts for consumer data processing. For more information, see Consumer data processing.

Service producers are no longer charged producer data processing for ingress or egress traffic through a Private Service Connect service attachment. For more information, see pricing for published services.

Bring your own IP v2 for regional addresses is available in General Availability.

• v2 public advertised prefixes are provisioned in approximately two weeks.
• v2 public delegated prefixes are provisioned in minutes.
• v2 prefixes are not automatically announced when provisioned; you control when to announce or withdraw advertisements.

The Private Service Connect interface documentation has been updated. Google recommends avoiding multi-tenant architectures, where multiple consumers connect to the same Private Service Connect interface VM. In a multi-tenant architecture, if one consumer terminates their Private Service Connect interface connection, other consumers that are connected to the same VM also lose connectivity. For more information, see Limitations.

You can use Packet Mirroring to collect IPv6 traffic. This feature is available in General Availability.

Internal ranges are available in General Availability. Internal ranges let you allocate blocks of private IP addresses in VPC networks and specify how those addresses can be used.

The VPC documentation has been updated with a new page that describes which services in Google Cloud include support for IPv6. For more information, see IPv6 support in Google Cloud.

Support for IPv6 extension headers is available in General Availability.

For auto mode VPC networks, added a new subnet 10.218.0.0/20 for the Johannesburg africa-south1 region. For more information, see Auto mode IP ranges.

Private Service Connect interfaces are available in General Availability. Private Service Connect interfaces let service producers initiate connections to consumer VPC networks.

Regional service endpoints that are used with Private Service Connect backends are now referred to as locational service endpoints. Locational service endpoints are different from regional service endpoints.

Private Service Connect endpoints support accessing regional service endpoints. This feature is available in Preview.

You can use Organization Policy Service custom constraints to provide more granular and customizable control over specific fields for some VPC resources. This feature is available in General Availability. For more information, see Manage VPC resources by using custom organization policies.

You can use Packet Mirroring to collect IPv6 traffic. This feature is available in General Availability.

This note is incorrect. The feature was released in Preview on this date.

Accessing supported global Google APIs through Private Service Connect backends is available in Preview.

You can use Private Service Connect backends to access published services that are hosted on regional internal Application Load Balancers and regional internal proxy Network Load Balancers.

Private Service Connect backends with published service targets can be added to global external TCP proxy Network Load Balancers. This feature is available in Preview.

Private Service Connect service connectivity automation is available in General Availability. Service connectivity automation lets service producers automate deployment and service connectivity to eligible managed services on behalf of consumers.

Private Service Connect backends support using an external regional TCP proxy load balancer or an internal regional TCP proxy load balancer to access published services. These features are available in General Availability.

For auto mode VPC networks, added a new subnet 10.216.0.0/20 for the Dammam me-central2 region. For more information, see Auto mode IP ranges.

Policy-based routing is available in General Availability. You can select a next hop based on more than a packet's destination IP address. You can match traffic by protocol and source IP address as well.

If you've used Google provider for Terraform versions earlier than 4.76.0 to create Private Service Connect service attachments, do not upgrade to versions 4.76.0 through 4.81.x. When you run terraform apply after the upgrade, Terraform might unintentionally delete and recreate the service attachments and close existing Private Service Connect connections. Recreated service attachments do not automatically re-establish Private Service Connect connections.

Upgrading to version 4.82.0 or later ensures that service attachments are not recreated.

Versions 4.76.0 and later turn on connection reconciliation by default, which might result in different service attachments having different settings for this field, depending on when they were created.

For more information and workarounds, see Disconnections after upgrading the Google provider for Terraform.

Support for IPv6 static routes with the following next hops is generally available (GA):

• next-hop-gateway
• next-hop-instance

You can add Resource Manager tags to supported VPC resources. For more information, see Create and manage tags for VPC resources.

For auto mode VPC networks, added a new subnet 10.214.0.0/20 for the Berlin europe-west10 region. For more information, see Auto mode IP ranges.

Private Service Connect backends with published service targets can be added to cross-region Application Load Balancers. This feature is available in Preview.

VLAN attachments for Cloud Interconnect that have Dataplane v1 can access Private Service Connect endpoints from hybrid networks. For more information, see access endpoints from hybrid networks.

Private Service Connect endpoints that have global access enabled can access published services that are based on the following load balancer configurations:

• Internal Application Load Balancer with global access enabled
• Regional internal proxy Network Load Balancer with global access enabled

Connection reconciliation is available in General Availability. When connection reconciliation is enabled for a service attachment, updating the service attachment's consumer accept or reject lists affects existing Private Service Connect connections in addition to new and pending connections.

New pages for Private Service Connect:

• Deployment patterns
• Architecture and performance

All service attachments, including those created before March 1, 2023, consume one NAT IP address for each connected endpoint or backend. For more information, see NAT subnet sizing.

You can publish a service that is hosted on an internal passthrough Network Load Balancer that forwards traffic on all ports (--ports=all). This feature is available in General Availability.

By default, public advertised prefixes can be used only to create regional public delegated prefixes. If you need to create global public delegated prefixes, you must request access. For more information about this behavior change and how to request access, see Behavior changes for BYOIP.

Moving a reserved external IPv4 address from one project to another is available in General Availability.

You can use custom constraints to provide more granular and customizable control over specific fields for some VPC resources. For more information, see Manage VPC resources by using custom constraints. This feature is available in Preview.

Service consumers can use organization policies with the compute.restrictPrivateServiceConnectProducer list constraint to block Private Service Connect endpoints and backends from connecting to service attachments in other organizations. For more information, see Block endpoints and backends from connecting to unauthorized service attachments.

Service producers can use organization policies with the compute.restrictPrivateServiceConnectConsumer list constraint to control which endpoints and backends can connect to Private Service Connect service attachments within a producer organization or project. For more information, see Block unauthorized endpoints and backends from connecting to service attachments.

These constraints are available in General Availability.

The connection preference for a Private Service Connect published service can be configured on the VPC network level in addition to project level. For more information, see Publish a service with explicit approval. This feature is available in General Availability.

Private Service Connect interfaces are available in Preview. Private Service Connect interfaces let service producers initiate connections to consumer VPC networks.

Support for IPv6 static routes with the following next hops is available in Preview:

• next-hop-gateway
• next-hop-instance

General Availability: You can use the private.googleapis.com and restricted.googleapis.com virtual IP addresses (VIPs) to access Google APIs and services with IPv6 addresses. For more information, see the following pages:

• Use the VIPs from VMs with internal IPv6 addresses
• Use the VIPs from VMs with external IPv6 addresses
• Use the VIPs from on-premises hosts with IPv6 addresses
• Use the VIPs with VPC Service Controls

Private Service Connect backends support using an external regional TCP proxy load balancer to access published services. This feature is available in Preview.

Reserving static regional internal IPv6 addresses is available in General Availability.

Reserving static regional external IPv6 addresses is available in General Availability.

Support for IPv6 extension headers is available in Preview.

Internal ranges are available in Preview. Internal ranges let you allocate blocks of private IP addresses in VPC networks and specify how those addresses can be used.

Private Service Connect service connectivity automation is available in Preview. Service connectivity automation lets service producers automate deployment and service connectivity to eligible managed services on behalf of consumers.

Global access for Private Service Connect endpoints for published services is available in General Availability. When global access is configured, clients in any region can send traffic to Private Service Connect endpoints.

Private Service Connect backends support using an internal regional TCP proxy load balancer to access published services. This feature is available in Preview.

Private Service Connect endpoints for published services can be configured with global access. When global access is configured, clients in any region can send traffic to endpoints. Global access for endpoints is available in Preview.

Documentation updates for Private Service Connect:

• Private Service Connect endpoints with consumer HTTP(S) controls are now called Private Service Connect backends. The documentation is updated to reflect this change.
• The Private Service Connect overview page is updated.
• New pages for Private Service Connect:
  • Private Service Connect compatibility: describes the features and compatibility of all Private Service Connect configurations and supported services.
  • About accessing published services through endpoints
  • About accessing Google APIs through endpoints
  • About published services
  • DNS configuration for published services

General Availability: Private Service Connect endpoints with consumer HTTP(S) controls support accessing regional Google APIs and published services using the following load balancers:

• Regional internal HTTP(S) load balancer
• Regional external HTTP(S) load balancer

For auto mode VPC networks, added a new subnet 10.212.0.0/20 for the Doha me-central1 region. For more information, see