About published services

This document provides an overview of using Private Service Connect to make a service available to service consumers.

As a service producer, you can use Private Service Connect to publish services by using internal IP addresses in your VPC network. Your published services are accessible to service consumers by using internal IP addresses in their VPC networks.

To make a service available to consumers, you create one or more dedicated subnets. You then create a service attachment that refers to those subnets. The service attachment can have different connection preferences.

Service consumer types

There are two types of consumers that can connect to a Private Service Connect service:

Endpoints are based on a forwarding rule.

An endpoint lets service consumers send traffic from the consumer's VPC network to services in the service producer's VPC network (click to enlarge).

Backends are based on a load balancer.

A backend that uses a global external Application Load Balancer lets service consumers with internet access send traffic to services in the service producer's VPC network (click to enlarge).

NAT subnets

Private Service Connect service attachments are configured with one or more NAT subnets (also referred to as Private Service Connect subnets). Packets from the consumer VPC network are translated using source NAT (SNAT) so that their original source IP addresses are converted to source IP addresses from the NAT subnet in the producer's VPC network.

Service attachments can have multiple NAT subnets. Additional NAT subnets can be added to the service attachment at any time without interrupting traffic.

While a service attachment can have multiple NAT subnets configured, a NAT subnet cannot be used in more than one service attachment.

Private Service Connect NAT subnets cannot be used for resources such as virtual machine (VM) instances or forwarding rules. The subnets are used only to provide IP addresses for SNAT of incoming consumer connections.

NAT subnet sizing

The subnet size determines how many consumers can connect to your service—if all of the IP addresses in the NAT subnet are consumed, any additional Private Service Connect connections fail. Consider the following:

  • One IP address is consumed from the NAT subnet for each endpoint or backend that is connected to the service attachment.

    The number of TCP or UDP connections, clients, or consumer VPC networks does not affect the consumption of IP addresses from the NAT subnet.

  • If connection propagation is used by consumers, an additional IP address is consumed for each VPC spoke that connections are propagated to, for each endpoint.

    You can control how many propagated connections are created by configuring the progated connection limit.

  • When you estimate how many IP addresses you need for endpoints and backends, account for any multi-tenant services or consumers that use