← ExplainersBhupendra YadavNov 2026bhupixb.github.io

The problem: A SaaS provider runs a database in its own GCP project. A customer wants to reach it privately from their own VPC: no VPC peering, no public IPs, no merging of IP ranges. The two VPCs may even use the same range. Private Service Connect (PSC) is GCP’s answer: the provider (the producer) publishes a service, and the customer (the consumer) gets a private IP in their own VPC that leads to it.
What this page is: Setting up PSC takes five resources. On the producer side: a PSC NAT subnet, a service attachment and a firewall rule. On the consumer side: an endpoint and a private DNS record. I could follow the steps, but I could not see why each piece was needed, so I asked Claude to build this page while I was learning how PSC works for YugabyteDB Managed on GCP.; It is an interactive walkthrough. Build the connection one resource at a time, send a packet to see how far it gets, and remove a piece to see exactly what breaks without it.
Words used below: YBM, “we”, “our VPC” = YugabyteDB Managed, the producer. Customer = the consumer. All names and IPs are made-up examples.
Assumes: Basic GCP networking: VPCs, subnets, firewall rules, internal load balancers.

Build a PSC connection, one piece at a time

Each step adds one piece. Press Send a packet to see how far a packet gets. Press the red button to remove the piece and see what breaks. When you know why each piece exists, the whole design follows.

The one idea to hold

The customer VPC and our VPC have no routes to each other, and here they even use the same range (10.1.0.0/16). The client and one of our nodes both have IP 10.1.0.11. Every piece below exists to make one connection work between two networks that cannot see each other.

Packet log

Press Send a packet. The log shows source and destination at each hop.

All the pieces on one table

Piece	Who	One-line job	Without it	Switchboard picture
NAT subnet	YBM	Gives each incoming connection a source IP that our VPC owns	Our node cannot reply. GCP will not create the attachment.	Visitor extensions
Service attachment	YBM	The door: points at the LB, holds the accept list	Nothing for the customer to point at	Switchboard with a guest list
Firewall rule	YBM	Lets NAT addresses reach the nodes on 5433, 9042	Nodes drop every packet	Staff take calls from visitor extensions
Endpoint	Customer	An IP in their VPC that leads to our door	Their apps have no address that goes to us	Speed-dial button in their office
DNS record	Customer	Gives the endpoint IP the name on our TLS certificate	Works with `sslmode=require` only. `verify-full` fails.	Name in the contact list

Example values: customer project acme-prod, region us-east1. Further reading: Google Cloud: Private Service Connect. More explainers.