Create and manage Private Service Connect interfaces
This page describes how producer network administrators can create and manage Private Service Connect interfaces. Private Service Connect interfaces let service producer Virtual Private Cloud (VPC) networks initiate connections to consumer VPC networks.
Before you begin
- You must enable the Compute Engine API in your project.
- Find the URL of the network attachment that you want to connect to.
- If the network attachment is configured to manually accept connections, ensure that a network administrator has added your project to the network attachment's accept list.
Roles
To get the permissions that you need to create Private Service Connect interfaces, ask your administrator to grant you the following IAM roles on your project:
-
Compute Instance Admin (v1) (
roles/compute.instanceAdmin.v1
) -
Compute Network Admin (
roles/compute.networkAdmin
)
For more information about granting roles, see Manage access to projects, folders, and organizations.
You might also be able to get the required permissions through custom roles or other predefined roles.
The Compute Instance Admin (v1) role contains the
compute.instances.pscInterfaceCreate
permission, which is required to create
Private Service Connect interfaces.
Create VMs with Private Service Connect interfaces
To create a Private Service Connect interface connection, you need a virtual machine (VM) instance that has at least two network interfaces. The first interface connects to a producer subnet. The other interfaces can be Private Service Connect interfaces that request connections to network attachments in different consumer VPC networks.
If a connection is accepted, Google Cloud assigns to the Private Service Connect interface an internal IP address from the subnet that is specified by the network attachment.
When you create a VM with multiple Private Service Connect interfaces, each Private Service Connect interface must connect to a different network attachment that is in a different VPC network.
If you create a Private Service Connect interface that refers to a network attachment that's configured to manually accept connections and the interface's project is not in the network attachment's accept list, creation of the Private Service Connect interface's VM fails. In this case, work with the consumer organization to add your project to the accept list, and then create a Private Service Connect interface.
When you create a Private Service Connect interface, you can optionally assign to it one or more internal alias IP ranges. If you plan to assign alias IP ranges, contact the consumer organization to determine the appropriate IP address ranges.
To assign an alias IP range, specify the prefix length of the range in CIDR notation. When you assign one or more alias IP ranges to a Private Service Connect interface, Google Cloud allocates the alias IP ranges from the primary IP address range of the subnet that's associated with the network attachment. The Private Service Connect interface's primary IP address is allocated from outside of any alias IP ranges. If there aren't enough IP addresses in the network attachment's subnet to allocate the primary IP address and alias IP ranges, creation of the Private Service Connect interface's VM fails. You can find the specific IP addresses that are assigned by describing the interface's VM.
To create dynamic Private Service Connect interfaces (Preview), use the gcloud CLI or send an API request.
Console
In the Google Cloud console, go to the VM instances page:
Click Create instance.
Enter a Name.
Select a Region that matches the region of the network attachment that you want to connect to.
Select a Zone.
Click Advanced options.
Click Networking.
In the Network interfaces section, click the first network interface, which is the primary network interface, and then do the following:
- Select a Network for the primary network interface.
- Select a Subnet for the primary network interface. This subnet must be in the same region as the Private Service Connect interface's network attachment.
Click Add a network interface.
For Interface type, select Private Service Connect.
Enter a Network attachment URL.
Select an IP stack type. To create a dual-stack Private Service Connect interface, the network attachment's subnet must be dual stack.
Optional: To add an alias IP range, in the Prefix length box, enter the prefix length—for example,
/30
. You can add multiple alias IP ranges by clicking Add IP range, and then entering the prefix length for each additional alias IP range that you want to add.Click Done.
Click Create.
gcloud
To create a VM with a virtual Private Service Connect interface, use the
gcloud compute instances create
command.gcloud compute instances create INSTANCE_NAME \ --zone=ZONE \ --machine-type=MACHINE_TYPE \ --image-project=IMAGE_PROJECT \ --image-family=IMAGE_FAMILY \ --network-interface='subnet=PRODUCER_SUBNET,no-address' \ --network-interface='network-attachment=ATTACHMENT_URI,stack-type=STACK_TYPE
Replace the following:
INSTANCE_NAME
: the name of the new instanceZONE
: the zone of the new instanceMACHINE_TYPE
: the instance's machine type, which can be predefined or custom—for example,n1-standard-1
IMAGE_PROJECT
: the project of the image familyFor example, if you specify
debian-12
as the image family, specifydebian-cloud
as the image project. You can view a list of available images, image projects, and image families by using thegcloud compute images list
command.IMAGE_FAMILY
: the image family of the instanceThis creates the VM with the most recent, non-deprecated OS image in the image family. For example, if you specify
debian-12
, Compute Engine uses the latest version of the OS image in the Debian 12 image family.PRODUCER_SUBNET
: the subnet of the VM's primary network interfaceThis subnet must be in the same region as the Private Service Connect interface's network attachment.
ATTACHMENT_URI
: the URI of the network attachment—for example:projects/CONSUMER_PROJECT_ID/regions/REGION/networkAttachments/ATTACHMENT_NAME
STACK_TYPE
: the stack type of the dynamic Private Service Connect interface.To create an interface with an IPv4 address, specify
IPV4_ONLY
(the default). To create an interface that uses both an IPv4 and an IPv6 address (dual-stack), specifyIPV4_IPV6
. You can only create a dual-stack interface if the interface's network attachment is associated with a dual-stack subnet.
To create a VM with a dynamic Private Service Connect interface (Preview), use the
gcloud beta compute instances create
command. Include a VLAN ID to specify the creation of a dynamic Private Service Connect interface.gcloud beta compute instances create INSTANCE_NAME \ --zone=ZONE \ --machine-type=MACHINE_TYPE \ --image-project=IMAGE_PROJECT \ --image-family=IMAGE_FAMILY \ --network-interface='subnet=PRODUCER_SUBNET,no-address' \ --network-interface='network-attachment=ATTACHMENT_URI,vlan=VLAN_ID,stack-type=STACK_TYPE'
Replace
VLAN_ID
with the VLAN ID of the dynamic Private Service Connect interface, which must be an integer from 2 to 255.VLAN IDs must be unique for each dynamic interface that shares a parent vNIC. You can reuse the same ID for other dynamic interfaces that are associated with different vNICs.
To assign alias IP ranges to a Private Service Connect interface, send the following request:
gcloud beta compute instances create INSTANCE_NAME \ --zone=ZONE \ --machine-type=MACHINE_TYPE \ --image-project=IMAGE_PROJECT \ --image-family=IMAGE_FAMILY \ --network-interface='subnet=PRODUCER_SUBNET,no-address' \ --network-interface='network-attachment=ATTACHMENT_URI,vlan=VLAN_ID,stack-type=STACK_TYPE,aliases=ALIAS_IP_RANGES'
Replace
ALIAS_IP_RANGES
with one or more alias IP ranges to assign to the interface. You can enter specific ranges (192.168.100.0/24
), specific IP addresses (192.168.100.1
), or prefix lengths in CIDR format (/24
). You can enter multiple values in a semicolon-separated list. You can't enter multiple values of different types. For example,192.168.100.0/24;/28
isn't supported.To create a VM with multiple Private Service Connect interfaces, include separate
--network-interface
flags for each interface, where each flag refers to a different network attachment.For dynamic Private Service Connect interfaces, the parent vNIC is determined by the order of flags in the command. The parent vNIC is the first vNIC that you specify before the dynamic interface.
You can create dynamic and virtual Private Service Connect interfaces that coexist on the same VM. For example, the following command creates a VM with both virtual and dynamic Private Service Connect interfaces.
The parent of the dynamic Private Service Connect interfaces that have VLAN IDs
2
and3
is the first vNIC, connecting toproducer-subnet
. The parent of the dynamic interface that has VLAN ID4
is the vNIC that connects toproducer-subnet-2
. The last interface is a virtual Private Service Connect interface.gcloud beta compute instances create producer-vm \ --zone=us-west-1a \ --network-interface='subnet=producer-subnet,no-address' \ --network-interface='network-attachment=projects/consumer-project/regions/us-west-1/networkAttachments/consumer-1-network-attachment,vlan=2' \ --network-interface='network-attachment=projects/consumer-project/regions/us-west-1/networkAttachments/consumer-2-network-attachment,vlan=3' \ --network-interface='network=producer-vpc-2,subnet=producer-subnet-2' \ --network-interface='network-attachment=projects/consumer-project/regions/us-west-1/networkAttachments/consumer-3-network-attachment,vlan=4' \ --network-interface='network-attachment=projects/consumer-project/regions/us-west-1/networkAttachments/consumer-4-network-attachment'
API
To create a VM with a virtual Private Service Connect interface, send a request to the
instances.insert
method.HTTP method and URL:
POST https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/zones/INSTANCE_ZONE/instances
Request JSON body:
{ "machineType": "zones/MACHINE_TYPE_ZONE/machineTypes/MACHINE_TYPE", "name": "VM_NAME", "disks": [ { "initializeParams": { "sourceImage": "projects/IMAGE_PROJECT/global/images/family/IMAGE_FAMILY" }, "boot": true } ], "networkInterfaces": [ { "network": "https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/global/networks/PRODUCER_NETWORK", "subnetwork": "https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/regions/SUBNET_REGION/subnetworks/PRODUCER_SUBNET" }, { "networkAttachment": "ATTACHMENT_URI", "stackType": "STACK_TYPE" } ] }
Replace the following:
PRODUCER_PROJECT_ID
: the ID of the VM's projectINSTANCE_ZONE
: the zone of the new instanceMACHINE_TYPE_ZONE
: the zone of the machine typeMACHINE_TYPE
: the instance's machine type, which can be predefined or custom—for example,n1-standard-1
VM_NAME
: the name of the VM instanceIMAGE_PROJECT
: the project of the image familyFor example, if you specify
debian-12
as the image family, specifydebian-cloud
as the image project. You can view a list of available images, image projects, and image families by using thegcloud compute images list
command.IMAGE_FAMILY
: the image family of the instanceThis creates the VM with the most recent, non-deprecated OS image in the image family. For example, if you specify
debian-12
, Compute Engine uses the latest version of the OS image in the Debian 12 image family.PRODUCER_NETWORK
: the network of the VM's primary network interfaceSUBNET_REGION
: the region of the subnet of the VM's primary network interfacePRODUCER_SUBNET
: the subnet of the VM's primary network interfaceThis subnet must be in the same region as the Private Service Connect interface's network attachment.
ATTACHMENT_URI
: the URI of the network attachment—for example:projects/CONSUMER_PROJECT_ID/regions/REGION/networkAttachments/ATTACHMENT_NAME
STACK_TYPE
: the stack type of the dynamic Private Service Connect interface.To create an interface with an IPv4 address, specify
IPV4_ONLY
(the default). To create an interface that uses both an IPv4 and an IPv6 address (dual-stack), specifyIPV4_IPV6
. You can only create a dual-stack interface if the interface's network attachment is associated with a dual-stack subnet.
To create a VM with a dynamic Private Service Connect interface (Preview), send a request to the beta version of the
instances.insert
method. Include a VLAN ID in the network interface object to specify the creation of a dynamic Private Service Connect interface.HTTP method and URL:
POST https://compute.googleapis.com/compute/beta/projects/PRODUCER_PROJECT_ID/zones/INSTANCE_ZONE/instances
Request JSON body:
{ "machineType": "zones/MACHINE_TYPE_ZONE/machineTypes/MACHINE_TYPE", "name": "VM_NAME", "disks": [ { "initializeParams": { "sourceImage": "projects/IMAGE_PROJECT/global/images/family/IMAGE_FAMILY" }, "boot": true } ], "networkInterfaces": [ { "network": "https://compute.googleapis.com/compute/beta/projects/PRODUCER_PROJECT_ID/global/networks/PRODUCER_NETWORK", "subnetwork": "https://compute.googleapis.com/compute/beta/projects/PRODUCER_PROJECT_ID/regions/SUBNET_REGION/subnetworks/PRODUCER_SUBNET" }, { "networkAttachment": "ATTACHMENT_URI", "vlan": VLAN_ID, "stackType": "IPV4_IPV6" } ] }
Replace
VLAN_ID
with the VLAN ID of the dynamic Private Service Connect interface, which must be an integer from 2 to 255.VLAN IDs must be unique for each dynamic interface that shares a parent vNIC. You can reuse the same ID for other dynamic interfaces that are associated with different vNICs.
To assign alias IP ranges to a Private Service Connect interface, include the
aliasesIpRanges
field.HTTP method and URL:
POST https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/zones/INSTANCE_ZONE/instances
Request JSON body:
{ "machineType": "zones/MACHINE_TYPE_ZONE/machineTypes/MACHINE_TYPE", "name": "VM_NAME", "disks": [ { "initializeParams": { "sourceImage": "projects/IMAGE_PROJECT/global/images/IMAGE" }, "boot": true } ], "networkInterfaces": [ { "network": "https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/global/networks/PRODUCER_NETWORK", "subnetwork": "https://compute.googleapis.com/compute/v1/projects/PRODUCER_PROJECT_ID/regions/SUBNET_REGION/subnetworks/PRODUCER_SUBNET" }, { "aliasIpRanges": [ { "ipCidrRange": "ALIAS_IP_RANGE" } ], "networkAttachment": "ATTACHMENT_URI" } ] }
Replace
ALIAS_IP_RANGE
with an alias IP ranges to assign to the interface. You can enter a specific range (192.168.100.0/24
), specific IP address (192.168.100.1
), or prefix length in CIDR format (/24
).You can specify multiple alias IP ranges in the
aliasIpRanges
array. Each range must be specified in the same form:"aliasIpRanges": [ { "ipCidrRange": "/28" }, { "ipCidrRange": "/30" } ]
To create a VM with multiple Private Service Connect interfaces, include separate objects in the
networkInterfaces
array for each interface, where each interface object refers to a different network attachment.For dynamic Private Service Connect interfaces, the parent vNIC is determined by the order of objects in the array. The parent vNIC is the first vNIC that you specify before the dynamic interface.
You can create dynamic and virtual Private Service Connect interfaces that coexist on the same VM. For example, the following request creates a VM with both virtual and dynamic Private Service Connect interfaces.
The parent of the dynamic Private Service Connect interfaces that have VLAN IDs
2
and3
is the first vNIC, connecting toproducer-subnet
. The parent of the dynamic interface that has VLAN ID4
is the vNIC that connects toproducer-subnet-2
. The last interface is a virtual Private Service Connect interface.{ "machineType": "zones/us-west-1a/machineTypes/e2-medium", "name": "producer-vm", "disks": [ { "initializeParams": { "sourceImage": "projects/debian-cloud/global/images/family/debian-11" }, "boot": true } ], "networkInterfaces": [ { "network": "https://www.googleapis.com/compute/beta/projects/producer-project-id/global/networks/producer-vpc-1", "subnetwork": "https://www.googleapis.com/compute/beta/projects/producer-project-id/regions/us-west-1/subnetworks/producer-subnet" }, { "networkAttachment": "projects/consumer-project1/regions/us-west-1/networkAttachments/consumer-1-network-attachment", "vlan": 2 }, { "networkAttachment": "projects/consumer-project2/regions/us-west-1/networkAttachments/consumer-2-network-attachment", "vlan": 3 }, { "network": "https://www.googleapis.com/compute/beta/projects/producer-project-id/global/networks/producer-vpc-2", "subnetwork": "https://www.googleapis.com/compute/beta/projects/producer-project-id/regions/us-west-1/subnetworks/producer-subnet-2" }, { "networkAttachment": "projects/consumer-project3/regions/us-west-1/networkAttachments/consumer-3-network-attachment", "vlan": 4 }, { "networkAttachment": "projects/consumer-project4/regions/us-west-1/networkAttachments/consumer-4-network-attachment" } ] } ```
For more information about creating VM instances, see Create and start a VM instance.
Add dynamic Private Service Connect interfaces to existing VMs
You can add a dynamic Private Service Connect interface to an existing VM without restarting the VM.
You must configure routing before traffic can flow through a new Private Service Connect interface.
gcloud
To add a single dynamic Private Service Connect
interface to an existing VM, use the
gcloud beta compute instances network-interfaces add
command.
To add multiple dynamic Private Service Connect interfaces, repeat the command for each interface that you want to add.
gcloud beta compute instances network-interfaces add INSTANCE_NAME \ --zone=ZONE \ --vlan=VLAN_ID \ --parent-nic-name=PARENT_NIC_NAME \ --network-attachment=ATTACHMENT_URI
Replace the following:
INSTANCE_NAME
: the name of the instance to updateZONE
: the zone of the instance to updateVLAN_ID
: an ID (integer from 2 to 4094) for the dynamic Private Service Connect interfaceVLAN IDs must be unique for each dynamic interface that shares a parent vNIC. You can reuse the same ID for other dynamic interfaces that are associated with different vNICs.
PARENT_NIC_NAME
: the name of the new VLAN NIC's parent network interface—for example,nic0
.ATTACHMENT_URI
: the URI of the network attachment—for example:projects/CONSUMER_PROJECT_ID/regions/REGION/networkAttachments/ATTACHMENT_NAME
API
To add a single dynamic Private Service Connect
interface to an existing VM, send a request to the beta version of the
instances.addNetworkInterface
method.
To add multiple dynamic Private Service Connect interfaces, repeat the request for each interface that you want to add.
HTTP method and URL:
POST https://compute.googleapis.com/compute/beta/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME/addNetworkInterface
Request JSON body:
{ "networkAttachment": "ATTACHMENT_URI", "parentNicName": "PARENT_NIC_NAME", "vlan": VLAN_ID }
Replace the following:
PROJECT_ID
: the ID of the VM's projectZONE
: the zone of the VMINSTANCE_NAME
: the name of the VM to updateATTACHMENT_URI
: the URI of the network attachment—for example:projects/CONSUMER_PROJECT_ID/regions/REGION/networkAttachments/ATTACHMENT_NAME
PARENT_NIC_NAME
: the name of the new VLAN NIC's parent network interface—for example,nic0
VLAN_ID
: an ID (integer from 2 to 4094) for the VLAN NIC Private Service Connect interfaceVLAN NIC interface IDs must be unique for each VLAN NIC under a parent network interface, but you can reuse the same ID for other VLAN NICs that are associated with different parent network interfaces.
Migrate from virtual to dynamic Private Service Connect interfaces
To configure your service to use dynamic Private Service Connect interfaces instead of virtual Private Service Connect interfaces, do the following.
- Create a VM that uses dynamic Private Service Connect interfaces.
- Configure routing for the new VM.
- Update your service to use the new VM.
- Delete the VM that uses virtual Private Service Connect interfaces.
Create and manage Private Service Connect interfaces by using instance templates
You can create and manage Private Service Connect interfaces by using instance templates.
After you create an instance template, you can use it to:
- Create a regional managed instance group (MIG) that uses Private Service Connect interfaces
Apply new configurations to an existing MIG, including adding or removing Private Service Connect interfaces
When you apply a new configuration to an existing MIG, you can specify minimum and maximum disruption levels for the automatic or selective update methods. MIGs that use Private Service Connect interfaces only support maximum disruption values of
RESTART
andREPLACE
. Operations to update MIGs with a maximum disruption level ofREFRESH
fail.
To create instance templates with dynamic Private Service Connect interfaces (Preview), use the Google Cloud CLI or send an API request.
To create instance templates that use alias IP ranges or multiple Private Service Connect interfaces, use the same syntax as creating VMs with Private Service Connect interfaces. Instance templates only support specifying alias IP ranges by prefix length.
Console
In the Google Cloud console, go to the Instance templates page:
Click Create instance template.
Enter a Name for the instance template.
Click Advanced options.
Click Networking.
In the Network interfaces section, click the
expander arrow.Select a Network and Subnetwork for the instance template's primary network interface.
Click Done.
Click Add a network interface.
Click Private Service Connect.
Select a Network and Subnetwork for your Private Service Connect interface.
Click Done.
Click Create.
gcloud
To create an instance template with a virtual Private Service Connect interface, use the
gcloud compute instance-templates create
command.gcloud compute instance-templates create NAME \ --machine-type=MACHINE_TYPE \ --image-project=IMAGE_PROJECT \ --image-family=IMAGE_FAMILY \ --region=REGION \ --network-interface='subnet=PRODUCER_SUBNET,no-address' \ --network-interface='network-attachment=ATTACHMENT_URI,stack-type=STACK_TYPE'
Replace the following:
NAME
: the name of the new instance templateMACHINE_TYPE
: the instance's machine type, which can be predefined or custom—for example,n1-standard-1
IMAGE_PROJECT
: the project of the image familyFor example, if you specify
debian-12
as the image family, specifydebian-cloud
as the image project. You can view a list of available images, image projects, and image families by using thegcloud compute images list
command.IMAGE_FAMILY
: the image family of the instanceThis creates the VM with the most recent, non-deprecated OS image in the image family. For example, if you specify
debian-12
, Compute Engine uses the latest version of the OS image in the Debian 12 image family.REGION
: the region of the instance template's producer subnet.PRODUCER_SUBNET
: the subnet of the instance templateWhen you create a VM by using this instance template, the VM's primary network interface is assigned an internal IP address from this subnet. This subnet must be in the same region as the Private Service Connect interface's network attachment.
ATTACHMENT_URI
: the URI of the network attachment—for example:projects/CONSUMER_PROJECT_ID/regions/REGION/networkAttachments/ATTACHMENT_NAME
STACK_TYPE
: the stack type of the instance template's dynamic Private Service Connect interface.To add an interface with an IPv4 address, specify
IPV4_ONLY
(the default). To add an interface that uses both an IPv4 and an IPv6 address (dual-stack), specifyIPV4_IPV6
. You can only create a dual-stack interface if the interface's network attachment is associated with a dual-stack subnet.
To create an instance template with a dynamic Private Service Connect interface, use the
gcloud beta compute instance-templates create
command.gcloud beta compute instance-templates create NAME \ --machine-type=MACHINE_TYPE \ --image-project=IMAGE_PROJECT \ --image-family=IMAGE_FAMILY \ --region=REGION \ --network-interface='subnet=PRODUCER_SUBNET,no-address' \ --network-interface='network-attachment=ATTACHMENT_URI,vlan=VLAN_ID,stack-type=STACK_TYPE'
Replace
VLAN_ID
with the VLAN ID of the dynamic Private Service Connect interface, which must be an integer from 2 to 255.VLAN IDs must be unique for each dynamic interface that shares a parent vNIC. You can reuse the same ID for other dynamic interfaces that are associated with different vNICs.
API
To create an instance template with a virtual Private Service Connect interface, make a request to the
instanceTemplates.insert
method.HTTP method and URL:
POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/instanceTemplates
Request JSON body:
{ "name": "NAME", "properties": { "disks": [ { "boot": true, "initializeParams": { "sourceImage": "projects/IMAGE_PROJECT/global/images/family/IMAGE_FAMILY" } } ], "machineType": "MACHINE_TYPE", "networkInterfaces": [ { "subnetwork": "https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/SUBNET_REGION/subnetworks/PRODUCER_SUBNET" }, { "networkAttachment": "ATTACHMENT_URI", "stackType": "STACK_TYPE" } ] } }
Replace the following:
PROJECT_ID
: the project ID of the instance templateNAME
: the name of the new instance templateIMAGE_PROJECT
: the project of the image familyFor example, if you specify
debian-12
as the image family, specifydebian-cloud
as the image project. You can view a list of available images, image projects, and image families by using thegcloud compute images list
command.IMAGE_FAMILY
: the image family of the instanceThis creates the VM with the most recent, non-deprecated OS image in the image family. For example, if you specify
debian-12
, Compute Engine uses the latest version of the OS image in the Debian 12 image family.MACHINE_TYPE
: the instance's machine type, which can be predefined or custom—for example,n1-standard-1
SUBNET_REGION
: the region of the instance template's producer subnet.PRODUCER_SUBNET
: the subnet of the instance templateWhen you create a VM by using this instance template, the VM's primary network interface is assigned an internal IP address from this subnet. This subnet must be in the same region as the Private Service Connect interface's network attachment.
ATTACHMENT_URI
: the URI of the network attachment—for example:projects/CONSUMER_PROJECT_ID/regions/REGION/networkAttachments/ATTACHMENT_NAME
STACK_TYPE
: the stack type of the instance template's dynamic Private Service Connect interface.To add an interface with an IPv4 address, specify
IPV4_ONLY
(the default). To add an interface that uses both an IPv4 and an IPv6 address (dual-stack), specifyIPV4_IPV6
. You can only create a dual-stack interface if the interface's network attachment is associated with a dual-stack subnet.
To create an instance template with a dynamic Private Service Connect interface, make a request to the beta version of the
instanceTemplates.insert
method.HTTP method and URL:
POST https://compute.googleapis.com/compute/beta/projects/PROJECT_ID/global/instanceTemplates
Request JSON body:
{ "name": "NAME", "properties": { "disks": [ { "boot": true, "initializeParams": { "sourceImage": "projects/IMAGE_PROJECT/global/images/family/IMAGE_FAMILY" } } ], "machineType": "MACHINE_TYPE", "networkInterfaces": [ { "subnetwork": "https://compute.googleapis.com/compute/beta/projects/PROJECT_ID/regions/SUBNET_REGION/subnetworks/PRODUCER_SUBNET" }, { "networkAttachment": "ATTACHMENT_URI", "vlan": VLAN_ID, "stackType": "STACK_TYPE" } ] } }
Replace
VLAN_ID
with the VLAN ID of the dynamic Private Service Connect interface, which must be an integer from 2 to 255.VLAN IDs must be unique for each dynamic interface that shares a parent vNIC. You can reuse the same ID for other dynamic interfaces that are associated with different vNICs.
For more information about creating instance templates, see Create instance templates.
Describe a Private Service Connect interface
You can describe a VM to view the details of its Private Service Connect interfaces. Each interface's name, IP address, alias IP ranges, network attachment, and consumer subnet are listed in the network interfaces section of the VM's description.
To describe a dynamic Private Service Connect interface, use the gcloud CLI or send an API request.
Console
In the Google Cloud console, go to the VM instances page.
Click the VM that has your Private Service Connect interface.
In the Network interfaces section, view the details of your Private Service Connect interface.
gcloud
gcloud beta compute instances describe VM_NAME --zone=ZONE
Replace the following:
VM_NAME
: the name of your interface's VM.ZONE
: your VM's zone.
API
GET https://compute.googleapis.com/compute/beta/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME
Replace the following:
PROJECT_ID
: the VM's project ID.ZONE
: the zone of the VM.VM_NAME
: the name of the VM.
Terminate Private Service Connect interface connections
To terminate a connection between a virtual Private Service Connect interface and a network attachment, delete the interface's VM.
To terminate a connection between a dynamic Private Service Connect interface and a network attachment, do one of the following:
- Remove the dynamic Private Service Connect interface.
- Delete the dynamic Private Service Connect interface's VM.
Remove a dynamic Private Service Connect interface
You can remove a dynamic Private Service Connect interface without restarting the associated VM.
gcloud
Use the gcloud beta compute instances network-interfaces delete
command.
gcloud beta compute instances network-interfaces delete INSTANCE_NAME \ --zone=ZONE \ --network-interface=INTERFACE_NAME
Replace the following:
INSTANCE_NAME
: the name of the interface's VM instanceZONE
: the zone of the interface's VM instanceINTERFACE_NAME
: the Google Cloud name of the dynamic Private Service Connect interface to deleteFor example,
nic0.10
is the name of a dynamic Private Service Connect interface, wherenic0
is the parent and10
is the VLAN ID.
API
Send a request to the beta version of the
instances.deleteNetworkInterface
method.
HTTP method and URL:
POST https://compute.googleapis.com/compute/beta/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME/deleteNetworkInterface?networkInterfaceName=INTERFACE_NAME
Replace the following:
PROJECT_ID
: the project ID of the interface's VMZONE
: the zone of the interface's VMINSTANCE_NAME
: the name of the interface's VMINTERFACE_NAME
: the Google Cloud name of the dynamic Private Service Connect interface to deleteFor example,
nic0.10
is the name of a dynamic Private Service Connect interface, wherenic0
is the parent vNIC name and10
is the VLAN ID.
Delete a VM with a Private Service Connect interface
Deleting a VM terminates any Private Service Connect interface connections.
For information about deleting a VM, see Delete an instance.
What's next?
- Configure routing for Private Service Connect interfaces.
- Configure security for a network that has a Private Service Connect interface connection.
- Manage destination overlap in a network that has a Private Service Connect interface connection.