Skip to main content

Google Cloud Private Service Connect for VeloDB Services

This reference lists the Google Cloud regions supported by VeloDB Services and the service attachment URI published in each region. It also explains how to create a Private Service Connect endpoint, connect it to the published service, and configure private DNS for supported VeloDB hostnames.

For the supported access paths and connection model, see VeloDB Services.

Requirements​

  • The VeloDB hostname and its Google Cloud region. The endpoint subnet and service attachment must be in this region.
  • A VPC and subnet from which clients can access the VeloDB service.
  • Permission to create Private Service Connect forwarding rules, internal addresses, firewall rules, and Cloud DNS records.
  • TCP port 443 allowed between clients and the endpoint.

Supported Regions and Service Attachments​

Google Cloud regionService attachment URI
us-west1projects/nifty-jet-418508/regions/us-west1/serviceAttachments/selectdb-byoc-us-west1-endpointservice-https
us-east4projects/nifty-jet-418508/regions/us-east4/serviceAttachments/pls-rv23q67r-https
us-central1projects/nifty-jet-418508/regions/us-central1/serviceAttachments/pls-q3u07fp7-https
us-west4projects/nifty-jet-418508/regions/us-west4/serviceAttachments/pls-g4sibc2l-https
europe-west3projects/nifty-jet-418508/regions/europe-west3/serviceAttachments/pls-44u4qo0z-https
asia-southeast1projects/nifty-jet-418508/regions/asia-southeast1/serviceAttachments/pls-pek0hd99-https
asia-east2projects/nifty-jet-418508/regions/asia-east2/serviceAttachments/pls-s0n6s96z-https

Step 1: Create a Private Service Connect endpoint​

  1. In the Google Cloud console, open Private Service Connect > Connected endpoints.
  2. Select Connect endpoint.
  3. For Target, select Published service.
  4. Enter the VeloDB Cloud service attachment URI for your region.
  5. Enter an endpoint name such as velodb-services.
  6. Select the client VPC and a subnet in the same region as the service attachment.
  7. Reserve or select an internal IPv4 address.
  8. Enable Global access if clients in other Google Cloud regions must use the endpoint.
  9. Create the endpoint.

If the endpoint is not accepted, send the following information to VeloDB Support:

  • VeloDB Cloud organization name
  • VeloDB hostname or hostnames that you plan to route through the endpoint
  • Consumer project ID
  • Region
  • Endpoint forwarding rule name
  • Endpoint internal IP address

Continue after the endpoint status changes to Accepted.

Step 2: Configure private DNS​

  1. Create or select a Cloud DNS private zone that is visible to the client VPC.

  2. If the private zone must cover VeloDB hostnames in multiple Google Cloud regions, use this private DNS name:

    gcp.velodb.cloud

    You can use a narrower zone such as us-east4.gcp.velodb.cloud if the VPC needs private access in only one region.

warning

A private DNS zone is authoritative for every hostname in its suffix. DNS does not fall back to the public zone when a hostname has no matching private record. If you use gcp.velodb.cloud, add records for every VeloDB hostname that clients must resolve, including each warehouse-specific Console hostname. Otherwise, missing hostnames return NXDOMAIN.

  1. Create an A record for each complete VeloDB hostname.
  2. Point the record to the Private Service Connect endpoint's internal IP address.

For example, create records for <warehouse-id>-studio.us-east4.gcp.velodb.cloud when privately accessing a warehouse-specific Console endpoint and apps-api.us-east4.gcp.velodb.cloud when privately accessing the Metrics API.

If multiple VPCs must resolve the hostname, make the private zone visible to every required network.

Step 3: Verify the connection​

From a client in the VPC, resolve each hostname that you configured. For example:

nslookup <warehouse-id>-studio.<region>.gcp.velodb.cloud
nslookup apps-api.<region>.gcp.velodb.cloud

The hostname must resolve to the reserved internal IP address of the Private Service Connect endpoint.

Verify TLS and HTTP routing with the original VeloDB hostname. Use the request documented for the service that you are accessing. For example:

curl -sS \
  -o /dev/null \
  -w 'remote_ip=%{remote_ip} http_code=%{http_code}\n' \
  https://apps-api.<region>.gcp.velodb.cloud/

Confirm that the remote address is private, TLS validation succeeds without --insecure, and the server returns an HTTP response. An unauthenticated request can return 401, 403, or a redirect.

Connect from an on-premises network​

  1. Connect the on-premises network to the VPC through Cloud Interconnect or Cloud VPN.
  2. Ensure that routes and firewall rules allow TCP 443 access to the endpoint IP.
  3. Configure corporate DNS to forward the regional VeloDB Cloud zone to a Cloud DNS inbound forwarding endpoint.

Troubleshooting​

ProblemChecks
Service attachment cannot be usedConfirm that the endpoint subnet and service attachment are in the same region.
Endpoint is pending or rejectedSend the consumer project and forwarding rule details to VeloDB Support.
VeloDB hostname resolves publiclyCheck private-zone visibility, record name, and DNS forwarding.
Connection times outCheck endpoint acceptance, firewall rules, routes, and TCP 443 access.
TLS validation failsUse the original VeloDB hostname, not the endpoint IP.