Private Service Connect for Lakebase
Configuring Private Service Connect for Lakebase keeps all traffic off the public internet. The endpoints you need depend on how your applications connect to Lakebase:
- Inbound Private Service Connect is required. It covers Databricks REST API calls and workspace traffic.
- Inbound Private Service Connect for performance-intensive services (Service Direct Private Link, port 5432) is required in one case: when your applications connect to Lakebase from outside the Databricks workspace. This applies when they use a Postgres client (such as psql, a Postgres driver, or an ORM) and a regional connection string. Connection strings without a region don't require this endpoint and remain accessible over the standard inbound Private Service Connect. Applications connecting from within the Databricks workspace, such as Databricks Apps or Feature Store connectors, don't require this endpoint. In-product UI pages (the SQL Editor, Tables editor, Query Stats, and Active queries) work over the existing front-end Private Service Connect and don't require it either. If your applications connect only through the Data API, you don't need this endpoint.
Lakebase routes these two traffic types through separate network paths, each with its own endpoint. Postgres client connections use a dedicated high-performance regional ingress with a hostname in the following form:
*.database.<region>.gcp.databricks.com
Private Service Connect endpoints
Endpoint | Traffic type | Port | Notes |
|---|---|---|---|
Databricks REST API and workspace connectivity | 443 | Standard Databricks workspace-level Private Service Connect. | |
Inbound Private Service Connect for performance-intensive services | Postgres database connections | 5432 | Covers the high-performance regional ingress used by Lakebase. Required for Postgres clients, drivers, and tools connecting to the database from outside the Databricks workspace using a regional connection string. |
Troubleshoot Private Service Connect connectivity
If the Tables editor or SQL Editor in the Lakebase App displays a "Failed to fetch" or "Unknown error" message and your workspace uses Private Service Connect, confirm that the workspace-level inbound Private Service Connect endpoint (port 443) is correctly configured. The in-product UI pages use this endpoint, not the performance-intensive services endpoint (port 5432).
If Postgres clients connecting from outside the workspace fail to connect, confirm that inbound Private Service Connect for performance-intensive services (port 5432) is configured. See Configure inbound Private Service Connect for performance-intensive services.