Skip to content

Commit 69e68a0

Browse files
micheleRPkbatuigasvbotbuildovichpaulohtb6
authored
DOC-1435 Add gcloud commands for firewall rules for PSC consumer (#377)
* DOC-1435 Add gcloud commands for creating firewall rules for PSC consumer * fix API docs similarly * Add Glue doc to Cloud (#363) * Add Glue pages to Cloud * Sync with docs main * Use docs branch with updated Cloud-specific guidance * Apply suggestion from PM review * Add What's New entry * Auth configs still need to be allowlisted for 25.1 in Cloud * Update local-antora-playbook.yml * Update @redpanda-data/docs-extensions-and-macros (#378) * docs: fix property alias (#379) * Fix heading for AWS Glue entry (#380) * minor edits * Paul's review feedback * copilot suggestions for consistency * coderabbit suggestions * move step into BYOVPC section * DOC-1435 Add gcloud commands for creating firewall rules for PSC consumer * fix API docs similarly * minor edits * Paul's review feedback * copilot suggestions for consistency * coderabbit suggestions * move step into BYOVPC section * fixes from coderabbit * minor edit * incorporate doc review suggestions --------- Co-authored-by: Kat Batuigas <[email protected]> Co-authored-by: vbotbuildovich <[email protected]> Co-authored-by: Paulo Borges <[email protected]>
1 parent 9e11b10 commit 69e68a0

File tree

7 files changed

+258
-176
lines changed

7 files changed

+258
-176
lines changed

‎modules/networking/pages/configure-private-service-connect-in-cloud-ui.adoc‎

Lines changed: 75 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,78 @@
33
:page-aliases: deploy:deployment-option/cloud/configure-private-service-connect-in-cloud-ui.adoc
44
:env-byoc: true
55

6-
include::networking:partial$psc-ui.adoc[]
6+
[NOTE]
7+
====
8+
9+
* This guide is for configuring GCP Private Service Connect using the Redpanda Cloud UI. To configure and manage Private Service Connect on an existing cluster with *public* networking, you must use the xref:networking:gcp-private-service-connect.adoc[Cloud API for BYOC] or the xref:networking:dedicated/gcp/configure-psc-in-api.adoc[Cloud API for Dedicated].
10+
* The latest version of Redpanda GCP Private Service Connect (available March, 2025) supports zone affinity. This allows requests from Private Service Connect endpoints to stay within the same availability zone, avoiding additional networking costs.
11+
* DEPRECATION: The original Redpanda GCP Private Service Connect is deprecated and will be removed in a future release. For more information, see xref:manage:maintenance.adoc#deprecated-features[Deprecated features].
12+
====
13+
14+
15+
The Redpanda GCP Private Service Connect service provides secure access to Redpanda Cloud from your own VPC network. Traffic over Private Service Connect does not go through the public internet because these connections are treated as their own private GCP service. While your VPC network has access to the Redpanda VPC network, Redpanda cannot access your VPC network.
16+
17+
Consider using Private Service Connect if you have multiple VPC networks and could benefit from a more simplified approach to network management.
18+
19+
[NOTE]
20+
====
21+
* Each consumer VPC network can have one Private Service Connect endpoint connected to the Redpanda service attachment.
22+
* Private Service Connect allows overlapping xref:networking:cidr-ranges.adoc[CIDR ranges] in VPC networks.
23+
* The number of connections is limited only by your Redpanda xref:reference:tiers/index.adoc[usage tier]. Private Service Connect does not add extra connection limits.
24+
* You control from which GCP projects connections are allowed.
25+
====
26+
27+
== Requirements
28+
29+
* Use the https://cloud.google.com/sdk/docs/install[gcloud^] command-line interface (CLI) to create the consumer-side resources, such as a consumer VPC network and forwarding rule, or to modify existing resources to use the Private Service Connect service attachment created for your cluster.
30+
* The consumer VPC network must be in the same region as your Redpanda cluster.
31+
32+
== Enable Private Service Connect for existing clusters
33+
34+
. In the Redpanda Cloud UI, open your https://cloud.redpanda.com/clusters[cluster^], and click **Cluster settings**.
35+
. Under Private Service Connect, click **Enable**.
36+
ifdef::env-byoc[]
37+
. For xref:get-started:cluster-types/byoc/gcp/vpc-byo-gcp.adoc[BYOVPC clusters], you need a PSC NAT subnet with `purpose` set to `PRIVATE_SERVICE_CONNECT`. You also need to create VPC network firewall rules to allow Private Service Connect traffic. You can use the `gcloud` CLI:
38+
+
39+
NOTE: The firewall rules support up to 20 Redpanda brokers. If you have more than 20 brokers, or for help enabling Private Service Connect, contact https://support.redpanda.com/hc/en-us/requests/new[Redpanda support^].
40+
+
41+
[source,bash]
42+
----
43+
gcloud compute networks subnets create <psc-nat-subnet-name> \
44+
--project=<host-project-id> \
45+
--network=<shared-vpc-name> \
46+
--region=<region> \
47+
--range=<psc-nat-subnet-range> \
48+
--purpose=PRIVATE_SERVICE_CONNECT
49+
----
50+
+
51+
[source,bash]
52+
----
53+
gcloud compute firewall-rules create redpanda-psc-ingress \
54+
--description="Allow access to Redpanda PSC endpoints" \
55+
--network="<shared-vpc-name>" \
56+
--project="<host-project-id>" \
57+
--direction="INGRESS" \
58+
--target-tags="redpanda-node" \
59+
--source-ranges="10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,100.64.0.0/10" \
60+
--allow="tcp:30181,tcp:30282,tcp:30292,tcp:31004,tcp:31082-31101,tcp:31182-31201,tcp:31282-31301,tcp:32092-32111,tcp:32192-32211,tcp:32292-32311"
61+
----
62+
+
63+
Provide your values for the following placeholders:
64+
+
65+
- `<psc-nat-subnet-name>`: The name of the PSC NAT subnet.
66+
- `<host-project-id>`: The host GCP project ID.
67+
- `<shared-vpc-name>`: The name of the VPC network being used for your Redpanda Cloud cluster.
68+
- `<region>`: The region of the Redpanda Cloud cluster.
69+
- `<psc-nat-subnet-range>`: The CIDR range of the subnet. The mask should be at least `/29`. Each Private Service Connect connection takes up one IP address from the PSC NAT subnet, so the CIDR must be able to accommodate all projects from which connections to the service attachment will be issued.
70+
+
71+
See the GCP documentation for https://cloud.google.com/vpc/docs/configure-private-service-connect-producer#add-subnet-psc[creating a subnet for Private Service Connect^].
72+
endif::[]
73+
. For the accepted consumers list, you need the GCP project IDs from which incoming connections will be accepted.
74+
. It may take several minutes for your cluster to update. When the update is complete, the Private Service Connect status in **Cluster settings** changes from **In progress** to **Enabled**.
75+
76+
include::networking:partial$psc-ui.adoc[]
77+
78+
== Disable Private Service Connect
79+
80+
In **Cluster settings**, click **Disable**. Existing connections are closed after it is disabled. To connect using Private Service Connect again, you must re-enable it.

‎modules/networking/pages/dedicated/gcp/configure-psc-in-api.adoc‎

Lines changed: 26 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -15,26 +15,11 @@ Copy and store the resource group ID (UUID) from the URL in the browser.
1515
export RESOURCE_GROUP_ID=<uuid>
1616
----
1717

18-
. Create VPC firewall rules to allow Private Service Connect traffic. Use the `gcloud` CLI to create the firewall rules:
19-
+
20-
NOTE: The firewall rules support up to 20 Redpanda brokers. If you have more than 20 brokers, or for help enabling Private Service Connect, contact https://support.redpanda.com/hc/en-us/requests/new[Redpanda support^].
21-
+
22-
```
23-
gcloud compute firewall-rules create redpanda-psc \
24-
--description="Allow access to Redpanda PSC endpoints" \
25-
--network="<shared-vpc-name>" \
26-
--project="<host-project-id>" \
27-
--direction="INGRESS" \
28-
--target-tags="redpanda-node" \
29-
--source-ranges="10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,100.64.0.0/10" \
30-
--allow="tcp:30181,tcp:30282,tcp:30292,tcp:31004,tcp:31082-31101,tcp:31182-31201,tcp:31282-31301,tcp:32092-32111,tcp:32192-32211,tcp:32292-32311"
31-
```
32-
3318
. Make a request to the xref:api:ROOT:cloud-controlplane-api.adoc#post-/v1/networks[`POST /v1/networks`] endpoint to create a network.
3419
+
3520
[,bash]
3621
----
37-
network_post_body=`cat << EOF
22+
NETWORK_POST_BODY=`cat << EOF
3823
{
3924
"cloud_provider": "CLOUD_PROVIDER_GCP",
4025
"cluster_type": "TYPE_DEDICATED",
@@ -54,7 +39,7 @@ EOF`
5439
curl -vv -X POST \
5540
-H "Content-Type: application/json" \
5641
-H "Authorization: Bearer $AUTH_TOKEN" \
57-
-d "$network_post_body" $PUBLIC_API_ENDPOINT/v1/networks
42+
-d "$NETWORK_POST_BODY" $PUBLIC_API_ENDPOINT/v1/networks
5843
----
5944
+
6045
Replace the following placeholder variables for the request body:
@@ -94,7 +79,7 @@ export CLUSTER_POST_BODY=`cat << EOF
9479
"gcp_private_service_connect": {
9580
"enabled": true,
9681
"consumer_accept_list": <consumer-accept-list>
97-
},
82+
}
9883
}
9984
EOF`
10085
@@ -110,7 +95,7 @@ curl -vv -X POST \
11095
- `<zones>`: Provide the list of GCP zones where the brokers will be deployed. Format: `["<zone 1>", "<zone 2>", "<zone N>"]`
11196
- `<throughput-tier>`: Choose a Redpanda Cloud cluster tier. For example, `tier-1-gcp-v2-x86`.
11297
- `<redpanda-version>`: Choose the Redpanda Cloud version.
113-
- `<consumer-accept-list>`: The list of IDs of GCP projects from which Private Service Connect connection requests are accepted. Format: `[{"source": "<GCP-project-ID-1>"}, {"source": "<GCP-project-I-2>"}, {"source": "<GCP-project-ID-N>"}]`
98+
- `<consumer-accept-list>`: The list of IDs of GCP projects from which Private Service Connect connection requests are accepted. Format: `[{"source": "<GCP-project-ID-1>"}, {"source": "<GCP-project-ID-2>"}, {"source": "<GCP-project-ID-N>"}]`
11499
--
115100

116101
== Enable Private Service Connect on an existing cluster
@@ -133,7 +118,7 @@ CLUSTER_PATCH_BODY=`cat << EOF
133118
{
134119
"gcp_private_service_connect": {
135120
"enabled": true,
136-
"consumer_accept_list": <accept-list>
121+
"consumer_accept_list": <consumer-accept-list>
137122
}
138123
}
139124
EOF`
@@ -145,7 +130,7 @@ curl -v -X PATCH \
145130
+
146131
Replace the following placeholder:
147132
+
148-
`<accept-list>`: a JSON list specifying the projects from which incoming connections will be accepted. All other sources. For example, `[{"source": "consumer-project-ID-1"},{"source": "consumer-project-ID-2"}]`.
133+
`<consumer-accept-list>`: A JSON list specifying the projects from which incoming connections will be accepted. All other sources are rejected. For example, `[{"source": "consumer-project-ID-1"},{"source": "consumer-project-ID-2"}]`.
149134
+
150135
Wait for the cluster to apply the new configuration (around 15 minutes). The Private Service Connect attachment is available when the cluster update is complete. To monitor the service attachment creation, run the following `gcloud` command with the project ID:
151136
+
@@ -155,4 +140,23 @@ gcloud compute service-attachments list --project '<service-project-id>'
155140
----
156141

157142

158-
include::networking:partial$psc-api2.adoc[]
143+
include::networking:partial$psc-ui.adoc[]
144+
145+
== Disable Private Service Connect
146+
147+
Make a xref:api:ROOT:cloud-controlplane-api.adoc#patch-/v1/clusters/-cluster.id-[`PATCH /v1/clusters/{cluster.id}`] request to update the cluster to disable Private Service Connect.
148+
149+
[,bash]
150+
----
151+
CLUSTER_PATCH_BODY=`cat << EOF
152+
{
153+
"gcp_private_service_connect": {
154+
"enabled": false
155+
}
156+
}
157+
EOF`
158+
curl -v -X PATCH \
159+
-H "Content-Type: application/json" \
160+
-H "Authorization: Bearer $AUTH_TOKEN" \
161+
-d "$CLUSTER_PATCH_BODY" $PUBLIC_API_ENDPOINT/v1/clusters/$CLUSTER_ID
162+
----

‎modules/networking/pages/dedicated/gcp/configure-psc-in-ui.adoc‎

Lines changed: 75 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,78 @@
22
:description: Set up GCP Private Service Connect in the Redpanda Cloud UI.
33
:env-dedicated: true
44

5-
include::networking:partial$psc-ui.adoc[]
5+
[NOTE]
6+
====
7+
8+
* This guide is for configuring GCP Private Service Connect using the Redpanda Cloud UI. To configure and manage Private Service Connect on an existing cluster with *public* networking, you must use the xref:networking:gcp-private-service-connect.adoc[Cloud API for BYOC] or the xref:networking:dedicated/gcp/configure-psc-in-api.adoc[Cloud API for Dedicated].
9+
* The latest version of Redpanda GCP Private Service Connect (available March, 2025) supports AZ affinity. This allows requests from Private Service Connect endpoints to stay within the same availability zone, avoiding additional networking costs.
10+
* DEPRECATION: The original Redpanda GCP Private Service Connect is deprecated and will be removed in a future release. For more information, see xref:manage:maintenance.adoc#deprecated-features[Deprecated features].
11+
====
12+
13+
14+
The Redpanda GCP Private Service Connect service provides secure access to Redpanda Cloud from your VPC network. Traffic over Private Service Connect remains within GCP's private network, avoiding the public internet. Your VPC network can access the Redpanda VPC network, but Redpanda cannot access your VPC network.
15+
16+
Consider using Private Service Connect if you have multiple VPC networks and could benefit from a more simplified approach to network management.
17+
18+
[NOTE]
19+
====
20+
* Each consumer VPC network can have one Private Service Connect endpoint connected to the Redpanda service attachment.
21+
* Private Service Connect allows overlapping xref:networking:cidr-ranges.adoc[CIDR ranges] in VPC networks.
22+
* The number of connections is limited only by your Redpanda usage tier. Private Service Connect does not add extra connection limits.
23+
* You control from which GCP projects connections are allowed.
24+
====
25+
26+
== Prerequisites
27+
28+
* Use the https://cloud.google.com/sdk/docs/install[gcloud^] command-line interface (CLI) to create the consumer-side resources, such as a consumer VPC network and forwarding rule, or to modify existing resources to use the Private Service Connect service attachment created for your cluster.
29+
* The consumer VPC network must be in the same region as your Redpanda cluster.
30+
31+
== Enable Private Service Connect for existing clusters
32+
33+
. In the Redpanda Cloud UI, open your https://cloud.redpanda.com/clusters[cluster^], and click **Cluster settings**.
34+
. Under Private Service Connect, click **Enable**.
35+
ifdef::env-byoc[]
36+
. For xref:get-started:cluster-types/byoc/gcp/vpc-byo-gcp.adoc[BYOVPC clusters], you need a NAT subnet with `purpose` set to `PRIVATE_SERVICE_CONNECT`. You also need to create VPC network firewall rules to allow Private Service Connect traffic. You can use the `gcloud` CLI:
37+
+
38+
NOTE: The firewall rules support up to 20 Redpanda brokers. If you have more than 20 brokers, or for help enabling Private Service Connect, contact https://support.redpanda.com/hc/en-us/requests/new[Redpanda support^].
39+
+
40+
[,bash]
41+
----
42+
gcloud compute networks subnets create <psc-nat-subnet-name> \
43+
--project=<host-project-id> \
44+
--network=<shared-vpc-name> \
45+
--region=<region> \
46+
--range=<psc-nat-subnet-range> \
47+
--purpose=PRIVATE_SERVICE_CONNECT
48+
----
49+
+
50+
[,bash]
51+
----
52+
gcloud compute firewall-rules create redpanda-psc-ingress \
53+
--description="Allow access to Redpanda PSC endpoints" \
54+
--network="<shared-vpc-name>" \
55+
--project="<host-project-id>" \
56+
--direction="INGRESS" \
57+
--target-tags="redpanda-node" \
58+
--source-ranges="10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,100.64.0.0/10" \
59+
--allow="tcp:30181,tcp:30282,tcp:30292,tcp:31004,tcp:31082-31101,tcp:31182-31201,tcp:31282-31301,tcp:32092-32111,tcp:32192-32211,tcp:32292-32311"
60+
----
61+
+
62+
Provide your values for the following placeholders:
63+
+
64+
- `<psc-nat-subnet-name>`: The name of the NAT subnet.
65+
- `<host-project-id>`: The host GCP project ID.
66+
- `<shared-vpc-name>`: The name of the VPC network being used for your Redpanda Cloud cluster.
67+
- `<region>`: The region of the Redpanda Cloud cluster.
68+
- `<psc-nat-subnet-range>`: The CIDR range of the subnet. The mask should be at least `/29`. Each Private Service Connect connection takes up one IP address from the NAT subnet, so the CIDR must be able to accommodate all projects from which connections to the service attachment will be issued.
69+
+
70+
See the GCP documentation for https://cloud.google.com/vpc/docs/configure-private-service-connect-producer#add-subnet-psc[creating a subnet for Private Service Connect^].
71+
endif::[]
72+
. For the accepted consumers list, you need the GCP project IDs from which incoming connections will be accepted.
73+
. It may take several minutes for your cluster to update. When the update is complete, the Private Service Connect status in **Cluster settings** changes from **In progress** to **Enabled**.
74+
75+
include::networking:partial$psc-ui.adoc[]
76+
77+
== Disable Private Service Connect
78+
79+
In **Cluster settings**, click **Disable**. Existing connections are closed after GCP Private Service Connect is disabled. To connect using Private Service Connect again, you must re-enable the service.

0 commit comments

Comments
 (0)