Neste documento, descrevemos o uso do Private Service Connect (PSC) para configurar o roteamento de clientes para a Apigee, também chamado de tráfego "norte".
Visão geral
É possível usar o PSC para conectar a VPC da Apigee com a VPC com que você
fez peering com a Apigee ou com qualquer outra VPC controlada por você. Esse padrão de arquitetura
elimina a necessidade de criar grupos de instâncias gerenciados para encaminhar solicitações do balanceador de
carga global para a Apigee. Com o método de roteamento PSC, as solicitações de proxy de API passam por
um balanceador de carga HTTP(S) externo global que você instala em uma VPC para um único
ponto de anexo na VPC da Apigee, chamado Anexo de serviço.
Essa configuração permite enviar
solicitações de proxy de API da Apigee de qualquer
máquina ativada para rede. Veja a Figura 1.
Observe os seguintes recursos de PSC compatíveis com o norte:
É possível usar o PSC com qualquer instância da Apigee.
É possível definir uma política de tráfego de detecção de outlier no serviço de back-end para processar automaticamente
os cenários de failover. Para saber mais, consulte os seguintes artigos:
O uso da PSC com a Apigee atualmente tem as seguintes restrições:
Como atualizar a lista de aceitação do consumidor de uma instância da Apigee
Em 10 de outubro de 2024, o limite de conexões de NEG do PSC permitido por projeto a uma instância da Apigee foi aumentado de
20 para 100. Para instâncias da Apigee criadas antes dessa data, siga as etapas desta seção para atualizar a lista de aceitação do consumidor e aproveitar o novo limite. Você só precisa fazer upgrade de cada
instância da Apigee uma vez para receber o novo limite de conexão. Consulte também os limites do Private Service Connect (PSC).
Se você precisar ter mais de 1.000 conexões NEG do PSC no total em todos os projetos do Cloud conectados a uma instância da Apigee, entre em contato com o suporte do Google Cloud.
Para atualizar a lista de aceitação do consumidor de uma instância da Apigee
e aproveitar o limite de conexão mais alto, siga estas etapas:
Crie um arquivo JSON chamado update_consumer_accept_list.json que contenha a lista atual de projetos aceitos retornados pelo comando anterior. Por exemplo:
Oferecemos suporte ao uso da PSC para roteamento na direção norte de clientes internos e externos. Para instruções detalhadas,
consulte a Etapa 8: configurar o roteamento
das instruções de provisionamento da CLI.
Expansão multirregional com o PSC
É possível expandir uma organização da Apigee em várias regiões e usar a PSC para roteamento na direção norte
nas novas regiões. Para detalhes, consulte
Como expandir a Apigee para várias regiões.
Como excluir uma instância da Apigee
Para excluir uma instância da Apigee que usa PSC, siga estas etapas:
Exclua a instância de ambiente de execução da Apigee usando a API Apigee. Essa
é uma operação de longa duração que pode levar até 20 minutos para ser concluída.
Recupere o estado da operação de longa duração usando a API Apigee.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-28 UTC."],[[["\u003cp\u003eThis page provides information on using Private Service Connect (PSC) for northbound traffic routing to Apigee, specifically excluding Apigee hybrid.\u003c/p\u003e\n"],["\u003cp\u003ePSC allows connecting the Apigee VPC with peered or controlled VPCs, eliminating the need for managed instance groups (MIGs) and instead using a global external HTTP(S) load balancer.\u003c/p\u003e\n"],["\u003cp\u003ePSC supports features like VPC Service Controls, outlier detection for failover, and can be used with any existing Apigee instance, as well as migrating from a MIG-based setup.\u003c/p\u003e\n"],["\u003cp\u003eThere are restrictions when using PSC with Apigee, including limitations on supported load balancer types, the number of project connections, and requirements for deleting existing NEGs upon removing a project.\u003c/p\u003e\n"],["\u003cp\u003eThe limit on PSC network endpoint group (NEG) connections per project has been raised to 100, requiring updates to the consumer accept list for instances created before October 10, 2024 to take advantage of the new limit.\u003c/p\u003e\n"]]],[],null,["# Northbound networking with Private Service Connect\n\n*This page\napplies to **Apigee** , but not to **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n\nThis document describes the use of [Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect) (PSC)\nto configure routing from clients to Apigee, also called \"northbound\" traffic.\n| **Pricing information:** For information on how PSC is metered and billed, see [Private Service Connect](https://cloud.google.com/vpc/pricing#psc-forwarding-rules) on the Virtual Private Cloud pricing page.\n\nOverview\n--------\n\n\nYou can use PSC to connect the Apigee VPC with the VPC that you\nhave peered with Apigee, or with any other VPC that you control. This architectural pattern\neliminates the need to create managed instance groups (MIGs) to forward requests from the global\nload balancer to Apigee. With the PSC routing method, API proxy requests pass through\na [global external HTTP(S) load balancer](https://cloud.google.com/load-balancing/docs/https) that you install in a VPC to a single\npoint of attachment in the Apigee VPC, called a [Service Attachment](https://cloud.google.com/vpc/docs/private-service-connect#service-attachments).\nThis configuration lets you send\nApigee API proxy requests from any\nnetwork-enabled machine. See Figure 1.\n\n\nNote the following supported northbound PSC features:\n\n- You can use PSC with any existing Apigee instance.\n- You can attach multiple PSC network endpoint groups (NEGs) to the Envoy-based, Google Cloud [global external HTTP(S) load balancer](/load-balancing/docs/https).\n- PSC is supported with [VPC Service Controls](/apigee/docs/api-platform/security/vpc-sc).\n- You can set an outlier detection traffic policy on the backend service for handling\n failover scenarios automatically. See the following for more information:\n\n - [Traffic policies](/load-balancing/docs/https/traffic-management-global#traffic_policies)\n - [Configure outlier detection](https://cloud.google.com/load-balancing/docs/https/setting-up-global-traffic-mgmt#configure_outlier_detection)\n - [REST\n Resource: backendServices](/compute/docs/reference/rest/v1/backendServices)\n\n| **Note:** If you currently use the MIG-based approach, you can migrate your system to PSC-based northbound routing. See [Migrate northbound routing from to PSC](/apigee/docs/api-platform/system-administration/migrate-from-mig-to-psc).\n\n**Figure 1: Private service connections**\n\nRestrictions\n------------\n\n\nThe use of PSC with Apigee currently has the following restrictions:\n| **Restrictions:** Note the following restrictions for PSC configuration:\n|\n| - [Global\n| external HTTP(S) load balancer (classic)](/load-balancing/docs/https) is not supported for this configuration.\n| - For failover with multiple PSC NEGs, active health checks are not supported. Use [outlier detection](/load-balancing/docs/https/traffic-management-global#traffic_policies) instead.\n| - Limits apply to the number of Google Cloud projects that can connect to an Apigee instance through PSC, and to the number of PSC NEG connections that you can have per project. For details, see [Private Service Connect (PSC) Limits](/apigee/docs/api-platform/reference/limits#private-service-connect-psc).\n| - If a Google cloud project is removed from `consumerAcceptList`, the existing PSC NEGs in that removed project will continue to work. However, any new NEGs will be rejected. You must delete existing NEGs if you remove their associated projects from the `consumerAcceptList`. Alternatively, you can recreate the Apigee instance, which recreates the service attachment in the Apigee project.\n\nUpdating the consumer accept list for an Apigee instance\n--------------------------------------------------------\n\nOn October 10, 2024, the limit on PSC NEG connections allowed per project to an Apigee instance was raised from\n20 to 100. For any Apigee instances created before that date, you must perform the steps in\nthis section to update the consumer accept list to take advantage of the new limit. You only need to upgrade each\nApigee instance once to receive the new connection limit. See also\n[Private Service Connect (PSC) Limits](/apigee/docs/api-platform/reference/limits#private-service-connect-psc).\n\nIf you need to have more than 1000 PSC NEG connections in total across all of the\nCloud projects connected to an Apigee instance, contact [Google Cloud Support](/apigee/docs/support/getting-started-with-support).\n\nTo update the consumer accept list of an Apigee instance\nto take advantage of the higher connection limit, do the following steps: \n\n### Cloud console\n\nFor detailed steps, see [Edit the accepted projects list](/apigee/docs/api-platform/system-administration/instances#accepted-projects).\n\n### Apigee API\n\nEdit the existing consumer accept list for your Apigee\ninstance. To use the [instances\nAPI](/apigee/docs/reference/apis/apigee/rest/v1/organizations.instances):\n\n1. Get the authentication token for the Apigee API: \n\n ```\n TOKEN=\"$(gcloud auth print-access-token)\"\n ```\n2. Get the list of Cloud projects in an instance's consumer accept list: \n\n ```\n curl https://apigee.googleapis.com/v1/organizations/PROJECT_ID/instances/INSTANCE_ID \\\n -H \"Authorization: Bearer $TOKEN\" -H Content-Type:application/json | jq .consumerAcceptList\n ```\n3. Create a JSON file named `update_consumer_accept_list.json` that contains the current list of accepted projects returned by the previous command. For example: \n\n ```\n {\n \"consumerAcceptList\": [\n \"dg-runtime-test1\",\n \"ne24b79b92c7db623p-tp\",\n \"dg-runtime-test2\",\n \"jd2fee78402218863p-tp\"\n ]\n }\n ```\n4. Optionally, edit the file to add more projects.\n5. Update the instance, using the JSON file you created as input. For example: \n\n ```\n curl https://apigee.googleapis.com/v1/organizations/PROJECT_ID/instances/INSTANCE_ID?updateMask=\"consumer_accept_list\" \\\n -X PATCH -H \"Authorization: Bearer $TOKEN\" -H Content-Type:application/json -d @update_consumer_accept_list.json\n ```\n\nConfigure PSC routing\n---------------------\n\n\nWe support using PSC for northbound routing from both internal and external clients. For detailed steps,\nsee [Step 8: Configure routing](/apigee/docs/api-platform/get-started/install-cli#configure-routing) of\nthe CLI provisioning instructions.\n\nMulti-region expansion with PSC\n-------------------------------\n\nYou can expand an Apigee organization across multiple regions and use PSC for northbound routing in the new regions. For details, see [Expanding Apigee to multiple regions](/apigee/docs/api-platform/system-administration/multi-region).\n\nDeleting an Apigee instance\n---------------------------\n\n\nTo delete an Apigee instance that uses PSC, follow these steps:\n\n1. [Remove and delete the PSC NEG backend](https://cloud.google.com/load-balancing/docs/cleaning-up-lb-setup#deleting_the_negs) from the external load balancer.\n2. Delete the Apigee runtime instance using the [Apigee API](/apigee/docs/reference/apis/apigee/rest/v1/organizations.instances/delete). This is a long-running operation that can take up to 20 minutes to complete.\n3. Optionally retrieve the long-running operation state using the [Apigee API](/apigee/docs/reference/apis/apigee/rest/v1/organizations.operations/get)."]]
