Skip to main content

Configure private connectivity to the per-warehouse Console endpoint on Google Cloud

This guide explains how to use Private Service Connect to access the per-warehouse Console endpoint privately from your Google Cloud VPC, without traversing the public internet.

For an overview of the connection model and its requirements, see Private connectivity to the per-warehouse Console endpoint.

Requirements​

  • The console hostname and its Google Cloud region.
  • A VPC and subnet that can be reached by users of the per-warehouse Console tools.
  • Permission to create Private Service Connect forwarding rules, internal addresses, firewall rules, and Cloud DNS records.
  • TCP port 443 allowed between clients and the endpoint.

Regional service attachments​

Google Cloud regionService attachment URI
us-west1projects/nifty-jet-418508/regions/us-west1/serviceAttachments/selectdb-byoc-us-west1-endpointservice-https
us-east4projects/nifty-jet-418508/regions/us-east4/serviceAttachments/pls-rv23q67r-https
us-central1projects/nifty-jet-418508/regions/us-central1/serviceAttachments/pls-q3u07fp7-https
us-west4projects/nifty-jet-418508/regions/us-west4/serviceAttachments/pls-g4sibc2l-https
europe-west3projects/nifty-jet-418508/regions/europe-west3/serviceAttachments/pls-44u4qo0z-https
asia-southeast1projects/nifty-jet-418508/regions/asia-southeast1/serviceAttachments/pls-pek0hd99-https
asia-east2projects/nifty-jet-418508/regions/asia-east2/serviceAttachments/pls-s0n6s96z-https

Step 1: Create a Private Service Connect endpoint​

  1. In the Google Cloud console, open Private Service Connect > Connected endpoints.
  2. Select Connect endpoint.
  3. For Target, select Published service.
  4. Enter the VeloDB Cloud service attachment URI for your region.
  5. Enter an endpoint name such as velodb-studio.
  6. Select the client VPC and a subnet in the same region as the service attachment.
  7. Reserve or select an internal IPv4 address.
  8. Enable Global access if clients in other Google Cloud regions must use the endpoint.
  9. Create the endpoint.

If the endpoint is not accepted, send the following information to VeloDB Support:

  • VeloDB Cloud organization name
  • Console hostname
  • Consumer project ID
  • Region
  • Endpoint forwarding rule name
  • Endpoint internal IP address

Continue after the endpoint status changes to Accepted.

Step 2: Configure private DNS​

  1. Create or select a Cloud DNS private zone that is visible to the client VPC.

  2. Use the most specific practical DNS name. For example:

    us-east4.gcp.velodb.cloud

  3. Create an A record for the complete console hostname.

  4. Point the record to the Private Service Connect endpoint's internal IP address.

The private DNS zone is authoritative for the entire regional suffix inside every VPC where the zone is visible. Cloud DNS does not fall back to the public zone when a hostname under that suffix has no matching private record. Add an A record for every per-warehouse Console hostname in the region that clients need to resolve. Otherwise, hostnames for other warehouses in the same region can return NXDOMAIN.

If multiple VPCs must resolve the hostname, make the private zone visible to every required network.

Step 3: Verify the connection​

From a client in the VPC, run:

nslookup <warehouse-id>-studio.<region>.gcp.velodb.cloud

The hostname must resolve to the reserved internal IP address of the Private Service Connect endpoint.

Verify TLS and HTTP routing:

curl -sS \
  -o /dev/null \
  -w 'remote_ip=%{remote_ip} http_code=%{http_code}\n' \
  https://<warehouse-id>-studio.<region>.gcp.velodb.cloud/webui_api/api/data/catalogs

Confirm that the remote address is private, TLS validation succeeds without --insecure, and the server returns an HTTP response. An unauthenticated request can return 401, 403, or a redirect.

Finally, open the warehouse in the VeloDB Console from an authenticated browser and use one of the covered tools, such as running a query in SQL Editor.

Connect from an on-premises network​

  1. Connect the on-premises network to the VPC through Cloud Interconnect or Cloud VPN.
  2. Ensure that routes and firewall rules allow TCP 443 access to the endpoint IP.
  3. Configure corporate DNS to forward the regional VeloDB Cloud zone to a Cloud DNS inbound forwarding endpoint.

Troubleshooting​

ProblemChecks
Service attachment cannot be usedConfirm that the endpoint subnet and service attachment are in the same region.
Endpoint is pending or rejectedSend the consumer project and forwarding rule details to VeloDB Support.
Console hostname resolves publiclyCheck private-zone visibility, record name, and DNS forwarding.
Connection times outCheck endpoint acceptance, firewall rules, routes, and TCP 443 access.
TLS validation failsUse the original console hostname, not the endpoint IP.