Docs Cloud Networking BYOC GCP Configure Private Service Connect in the Cloud UI Configure GCP Private Service Connect in the Cloud UI This guide is for configuring GCP Private Service Connect using the Redpanda Cloud UI. To configure and manage Private Service Connect on an existing cluster with public networking, you must use the Cloud API for BYOC or the Cloud API for Dedicated. The latest version of Redpanda GCP Private Service Connect (available March, 2025) supports zone affinity. This allows requests from Private Service Connect endpoints to stay within the same availability zone, avoiding additional networking costs. DEPRECATION: The original Redpanda GCP Private Service Connect is deprecated and will be removed in a future release. For more information, see Deprecated features. The Redpanda GCP Private Service Connect service provides secure access to Redpanda Cloud from your own VPC network. Traffic over Private Service Connect does not go through the public internet because these connections are treated as their own private GCP service. While your VPC network has access to the Redpanda VPC network, Redpanda cannot access your VPC network. Consider using Private Service Connect if you have multiple VPC networks and could benefit from a more simplified approach to network management. Each consumer VPC network can have one Private Service Connect endpoint connected to the Redpanda service attachment. Private Service Connect allows overlapping CIDR ranges in VPC networks. The number of connections is limited only by your Redpanda usage tier. Private Service Connect does not add extra connection limits. You control from which GCP projects connections are allowed. Requirements Use the gcloud command-line interface (CLI) to create the consumer-side resources, such as a consumer VPC network and forwarding rule, or to modify existing resources to use the Private Service Connect service attachment created for your cluster. The consumer VPC network must be in the same region as your Redpanda cluster. Enable Private Service Connect for existing clusters In the Redpanda Cloud UI, open your cluster, and click Cluster settings. Under Private Service Connect, click Enable. For BYOVPC clusters, you need a PSC NAT subnet with purpose set to PRIVATE_SERVICE_CONNECT. You also need to create VPC network firewall rules to allow Private Service Connect traffic. You can use the gcloud CLI: The firewall rules support up to 20 Redpanda brokers. If you have more than 20 brokers, or for help enabling Private Service Connect, contact Redpanda support. gcloud compute networks subnets create <psc-nat-subnet-name> \ --project=<host-project-id> \ --network=<shared-vpc-name> \ --region=<region> \ --range=<psc-nat-subnet-range> \ --purpose=PRIVATE_SERVICE_CONNECT gcloud compute firewall-rules create redpanda-psc-ingress \ --description="Allow access to Redpanda PSC endpoints" \ --network="<shared-vpc-name>" \ --project="<host-project-id>" \ --direction="INGRESS" \ --target-tags="redpanda-node" \ --source-ranges="10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,100.64.0.0/10" \ --allow="tcp:30181,tcp:30282,tcp:30292,tcp:31004,tcp:31082-31101,tcp:31182-31201,tcp:31282-31301,tcp:32092-32111,tcp:32192-32211,tcp:32292-32311" Provide your values for the following placeholders: <psc-nat-subnet-name>: The name of the PSC NAT subnet. <host-project-id>: The host GCP project ID. <shared-vpc-name>: The name of the VPC network being used for your Redpanda Cloud cluster. <region>: The region of the Redpanda Cloud cluster. <psc-nat-subnet-range>: The CIDR range of the subnet. The mask should be at least /29. Each Private Service Connect connection takes up one IP address from the PSC NAT subnet, so the CIDR must be able to accommodate all projects from which connections to the service attachment will be issued. See the GCP documentation for creating a subnet for Private Service Connect. For the accepted consumers list, you need the GCP project IDs from which incoming connections will be accepted. It may take several minutes for your cluster to update. When the update is complete, the Private Service Connect status in Cluster settings changes from In progress to Enabled. Deploy consumer-side resources For each consumer VPC network, you must complete the following steps to successfully connect to the service attachment and use the Kafka API and other Redpanda services, such as HTTP Proxy. In Cluster settings, copy the DNS zone and Service attachment URL under Private Service Connect. Use this URL to create the Private Service Connect endpoint in GCP. Get the name of the consumer VPC network and the subnet <psc-endpoint-subnet>, where the Private Service Connect endpoint forwarding rule will be created. Create a Private Service Connect IP address for the endpoint: gcloud compute addresses create <psc-endpoint-ip-name> --subnet=<psc-endpoint-subnet> --addresses=<psc-endpoint-ip> --region=<region> Create the Private Service Connect endpoint forwarding rule: gcloud compute forwarding-rules create <psc-endpoint-forwarding-rule-name> --region=<region> --network=<consumer-vpc-name> --address=<psc-endpoint-ip> --target-service-attachment=<rp-psc-service-attachment-url> Create firewall rules allowing egress traffic to the Private Service Connect endpoint: gcloud compute firewall-rules create redpanda-psc-egress \ --description="Allow access to Redpanda PSC endpoint" \ --network="<consumer-vpc-name>" \ --direction="EGRESS" \ --destination-ranges=<psc-endpoint-ip> \ --allow="tcp:443,tcp:30081,tcp:30282,tcp:30292,tcp:32092-32141,tcp:35082-35131,tcp:32192-32241,tcp:35182-35231,tcp:32292-32341,tcp:35282-35331" Create a private DNS zone. Use the cluster DNS zone value as the DNS name: gcloud dns managed-zones create <dns-zone-name> \ --project=<gcp-project-id> \ --description="Redpanda Private Service Connect DNS zone" \ --dns-name="<dns-zone-from-the-ui>" \ --visibility="private" \ --networks="<consumer-vpc-name>" In the newly-created DNS zone, create a wildcard DNS record using the cluster DNS record value: gcloud dns record-sets create '*.<dns-zone-from-the-ui>' \ --project=<gcp-project-id> \ --zone="<dns-zone-name>" \ --type="A" \ --ttl="300" \ --rrdatas="<psc-endpoint-ip>" Access Redpanda services through Private Service Connect endpoint After you have enabled Private Service Connect for your cluster, your connection URLs are available in the How to Connect section of the cluster overview in the Redpanda Cloud UI. You can access Redpanda services such as Schema Registry and HTTP Proxy from the client VPC or virtual network; for example, from a compute instance in the VPC or network. The bootstrap server hostname is unique to each cluster. The service attachment exposes a set of bootstrap ports for access to Redpanda services. These ports load balance requests among brokers. Make sure you use the following ports for initiating a connection from a consumer: Redpanda service Default bootstrap port Kafka API 30292 HTTP Proxy 30282 Schema Registry 30081 Access Kafka API seed service Use port 30292 to access the Kafka API seed service. export RPK_BROKERS='<kafka-api-bootstrap-server-hostname>:30292' rpk cluster info -X tls.enabled=true -X user=<user> -X pass=<password> When successful, the rpk output should look like the following: CLUSTER ======= redpanda.rp-cki01qgth38kk81ard3g BROKERS ======= ID HOST PORT RACK 0* 0-3da65a4a-0532364.cki01qgth38kk81ard3g.fmc.dev.cloud.redpanda.com 32092 use2-az1 1 1-3da65a4a-63b320c.cki01qgth38kk81ard3g.fmc.dev.cloud.redpanda.com 32093 use2-az1 2 2-3da65a4a-36068dc.cki01qgth38kk81ard3g.fmc.dev.cloud.redpanda.com 32094 use2-az1 Access Schema Registry seed service Use port 30081 to access the Schema Registry seed service. curl -vv -u <user>:<password> -H "Content-Type: application/vnd.schemaregistry.v1+json" --sslv2 --http2 <schema-registry-bootstrap-server-hostname>:30081/subjects Access HTTP Proxy seed service Use port 30282 to access the Redpanda HTTP Proxy seed service. curl -vv -u <user>:<password> -H "Content-Type: application/vnd.kafka.json.v2+json" --sslv2 --http2 <http-proxy-bootstrap-server-hostname>:30282/topics Test the connection You can test the Private Service Connect connection from any VM or container in the consumer VPC. If configuring a client isn’t possible right away, you can do these checks using rpk or curl: Set the following environment variables. export RPK_BROKERS='<kafka-api-bootstrap-server-hostname>:30292' export RPK_TLS_ENABLED=true export RPK_SASL_MECHANISM="<SCRAM-SHA-256 or SCRAM-SHA-512>" export RPK_USER=<user> export RPK_PASS=<password> Create a test topic. rpk topic create test-topic Produce to the test topic. rpk curl echo 'hello world' | rpk topic produce test-topic curl -s \ -X POST \ "<http-proxy-bootstrap-server-url>/topics/test-topic" \ -H "Content-Type: application/vnd.kafka.json.v2+json" \ -d '{ "records":[ { "value":"hello world" } ] }' Consume from the test topic. rpk curl rpk topic consume test-topic -n 1 curl -s \ "<http-proxy-bootstrap-server-url>/topics/test-topic/partitions/0/records?offset=0&timeout=1000&max_bytes=100000"\ -H "Accept: application/vnd.kafka.json.v2+json" Disable Private Service Connect In Cluster settings, click Disable. Existing connections are closed after it is disabled. To connect using Private Service Connect again, you must re-enable it. Back to top × Simple online edits For simple changes, such as fixing a typo, you can edit the content directly on GitHub. Edit on GitHub Or, open an issue to let us know about something that you want us to change. Open an issue Contribution guide For extensive content updates, or if you prefer to work locally, read our contribution guide . Was this helpful? thumb_up thumb_down group Ask in the community mail Share your feedback group_add Make a contribution 🎉 Thanks for your feedback! Add a Peering Connection Configure Private Service Connect with the Cloud API