Red Hat SummitChapter 1. Private Service Connect overview
You can create a private OpenShift Dedicated cluster on Google Cloud using Google Cloud’s security-enhanced networking feature Private Service Connect (PSC).
1.1. Understanding Private Service Connect
Private Service Connect (PSC), a capability of Google Cloud networking, enables private communication between services across different projects or organizations within Google Cloud. Users that implement PSC as part of their network connectivity can deploy OpenShift Dedicated clusters in a private and secured environment within Google Cloud without any public facing cloud resources.
For more information about PSC, see Private Service Connect.
PSC is only available on OpenShift Dedicated version 4.17 and later, and is only supported by the Customer Cloud Subscription (CCS) infrastructure type.
1.2. Prerequisites
In addition to the prerequisites that you need to complete before deploying any OpenShift Dedicated on Google Cloud cluster, you must also complete the following prerequisites to deploy a private cluster using Private Service Connect (PSC):
A pre-created Virtual Private Cloud (VPC) with the following subnets in the same Google Cloud region where your cluster will be deployed:
- A control plane subnet
- A worker subnet
A subnet used for the PSC service attachment with the purpose set to Private Service Connect
ImportantThe subnet mask for the PSC service attachment must be /29 or larger and must be dedicated to an individual OpenShift Dedicated cluster. Additionally, the subnet must be contained within the Machine CIDR range used while provisioning the OpenShift Dedicated cluster.
For information about how to create a VPC on Google Cloud, see Create and manage VPC networks in the Google Cloud documentation.
- Provide a path from the OpenShift Dedicated cluster to the internet for the domains and ports listed in the Google Cloud firewall prerequisites in the Additional resources section.
- Enabled Cloud Identity-Aware Proxy API at the Google Cloud project level.
In addition to the requirements listed above, clusters configured with the Service Account authentication type must grant the IAP-Secured Tunnel User role to osd-ccs-admin service account.
For more information about the prerequisites that must be completed before deploying an OpenShift Dedicated on Google Cloud, see Customer Requirements.
PSC is supported with the Customer Cloud Subscription (CCS) infrastructure type only. To create an OpenShift Dedicated on Google Cloud using PSC, see Creating a cluster on Google Cloud with Workload Identity Federation.
1.3. Private Service Connect architecture
The Private Service Connect (PSC) architecture includes producer services and consumer services. Using PSC, the consumers can access producer services privately from inside their VPC network. Similarly, it allows producers to host services in their own separate VPC networks and offer a private connect to their consumers.
The following image depicts how Red HAT SREs and other internal resources access and support clusters created using PSC.
- A unique PSC service attachment is created for each OSD cluster in the customer Google Cloud project. The PSC service attachment points to the cluster API server load balancer created in the customer Google Cloud project.
- Similar to service attachments, a unique PSC endpoint is created in the Red Hat Management Google Cloud project for each OSD cluster.
- A dedicated subnet for Google Cloud Private Service Connect is created in the cluster’s network within the customer Google Cloud project. This is a special subnet type where the producer services are published via PSC service attachments. This subnet is used to Source NAT (SNAT) incoming requests to the cluster API server. Additionally, the PSC subnet must be within the Machine CIDR range and cannot be used in more than one service attachment.
- Red Hat internal resources and SREs access private OSD clusters using the connectivity between a PSC endpoint and service attachment. Even though the traffic transits multiple VPC networks, it remains entirely within Google Cloud.
- Access to PSC service attachments is possible only via the Red Hat Management project.
Figure 1.1. PSC architecture overview
1.4. Next steps
- To learn more about OpenShift Dedicated on Google Cloud cluster prerequisites, see Customer Requirements.
- To configure your firewalls, see Google Cloud firewall prerequisites.
- To create an OpenShift Dedicated on Google Cloud using PSC with the Workload Identity Federation authentication type, see Creating a cluster on Google Cloud with Workload Identity Federation authentication.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}