Chapter 2. Creating a GCP Private Service Connect enabled private cluster

Private Service Connect (PSC), a capability of Google Cloud networking, enables private communication between services across different projects or organizations within GCP. Users that implement PSC as part of their network connectivity can deploy OpenShift Dedicated clusters in a private and secured environment within Google Cloud Platform (GCP) without any public facing cloud resources. For more information on PSC, see Private Service Connect.

2.1.1. Private Service Connect architecture

The PSC architecture includes producer services and consumer services. Using PSC, the consumers can access producer services privately from inside their VPC network. Similarly, it allows producers to host services in their own separate VPC networks and offer a private connect to their consumers.

The following image depicts how Red HAT SREs and other internal resources access and support clusters created using PSC.

• A unique PSC Service Attachment is created for each OSD cluster in the customer GCP project. The PSC Service Attachment points to the cluster API server load balancer created in the customer GCP project.
• Similar to Service Attachments, a unique PSC Service Endpoint is created in the Red Hat Management GCP project for each OSD cluster.
• A dedicated subnet for GCP Private Service Connect is created in the cluster’s network within the customer GCP project. This is a special subnet type where the producer services are published via PSC Service Attachments. This subnet is used to Source NAT (SNAT) incoming requests to the cluster API server. Additionally, the PSC subnet must be within the Machine CIDR range and cannot be used in more than one Service Attachment.
• Red Hat internal resources and SREs access private OSD clusters using the connectivity between a PSC Endpoint and Service Attachment. Even though the traffic transits multiple VPC networks, it remains entirely within Google Cloud.
• Access to PSC Service Attachments is possible only via the Red Hat Management project.

Figure 2.1. PSC architecture overview

In addition to the prerequisites that you need to complete before deploying any OpenShift Dedicated on Google Cloud Platform (GCP) cluster, you must also complete the following prerequisites to deploy a private cluster using Private Service Connect (PSC):

In addition to the requirements listed above, clusters configured with the Service Account authentication type must grant the IAP-Secured Tunnel User role to osd-ccs-admin service account.

For more information about the prerequisites that must be completed before deploying an OpenShift Dedicated on Google Cloud Platform (GCP), see Additional resources.

Private Service Connect is supported with the Customer Cloud Subscription (CCS) infrastructure type only. To create an OpenShift Dedicated on Google Cloud Platform (GCP) using PSC, see Creating a cluster on GCP with Google Cloud Marketplace.

For information on OpenShift Dedicated on Google Cloud Platform (GCP) cluster prerequisites, see Customer Requirements.

For information about configuring your firewalls , see GCP firewall prerequisites.