Connect to on-premises resources using a Private Service Connect service
A Private Service Connect service provides a dedicated, private connection from serverless compute to resources in your VPC and in transitively connected networks, such as your on-premises network. Serverless compute connects to a private endpoint in your network connectivity configuration (NCC), which connects to a load balancer in your VPC. The load balancer routes traffic to your target resources.
What problem it solves
A Private Service Connect service establishes a dedicated, private connection from serverless compute to:
- Cloud services that don't support Private Service Connect directly.
- Resources in your VPC and transitively connected networks, such as databases hosted on VMs and custom TCP applications.
- On-premises resources over Cloud Interconnect or a site-to-site VPN.
When to use a Private Service Connect service
Use a Private Service Connect service when you want to connect serverless compute to services and resources in your VPC, or in networks connected to it, that don't support Private Service Connect directly.
How it works
You expose your resources to serverless compute through an internal TCP proxy load balancer and a Private Service Connect service attachment:
- Create a hybrid connectivity network endpoint group (NEG), and add the private IP address and port of your target resource as endpoints.
- Create a regional proxy-only subnet, and advertise it to your on-premises network using BGP.
- Set up an internal TCP proxy load balancer with the hybrid NEG as its backend.
- Publish a Private Service Connect service attachment, using a dedicated NAT subnet, that fronts the forwarding rule of the load balancer.
- Expose the service attachment to Databricks through a private endpoint rule in an NCC.
For detailed steps, see Configure private connectivity to resources in your VPC.
Considerations
Review the following before you use a Private Service Connect service:
- This is not a managed solution. You must provision, monitor, and maintain infrastructure such as load balancers, which adds cost and operational overhead.
- This approach requires deep technical knowledge, especially of proxy configuration and custom routing.
- Application teams might need to work with infrastructure teams each time they connect to a new resource.
Before you set up a Private Service Connect service, check whether your target resource supports a direct private endpoint rule. See Serverless compute plane networking.