Skip to main content
Version: User Guides (Cloud)

Set up a Private Service Connect (GCP)

This guide demonstrates the procedure for setting up a private endpoint from a Zilliz Cloud cluster to your service hosted in different GCP VPCs.

This feature is exclusively available to Dedicated (Enterprise) clusters.

📘Notes

Zilliz Cloud does not charge you for private links. However, your cloud provider may charge you for each endpoint that you create to access Zilliz Cloud.

Before you start​

Make sure the following conditions are met:

  • You have signed up for Zilliz Cloud.

  • A cluster has been created. For information on how to create a cluster, see Create Cluster.

Add a private endpoint​

Zilliz Cloud offers you an intuitive wizard to add a private endpoint. On the Cluster Details tab of any dedicated cluster in your project, click + Private Endpoint and configure the settings.

enter_vpc_endpoint_gcp

Setting up a private link is project-level. When you configure a private link for a cluster, it applies to its neighboring clusters in the same project deployed in the same cloud region.

Select a cloud provider and region​

To create a private endpoint for a cluster deployed in a Google Cloud region, select Google Cloud from the Cloud Provider drop-down list. In Region, select the region that accommodates the cluster you want to access privately. For more information on available cloud providers and regions, see Cloud Providers & Regions.

📘Notes

Once you have created a private link in a project, it applies immediately to its member Dedicated (Enterprise) clusters that have been deployed in the specified region. For those clusters that undergo maintenance then, such as scaling or patch-fixing, the private link applies to them after maintenance.

Enter Your Google Cloud Project ID and Endpoint​

In the Create Private Endpoint dialog box, you also need to fill in Google Cloud project ID and Your Endpoint for us to establish private connections.

enter_vpc_endpoint_gcp_02

If you do not have this information, you can click Don't Have a VPC Endpoint? to follow the guidance on the console and guidance in the following sections. Otherwise, enter Your Endpoint and Google Cloud Project ID, click Create, and go to Obtain a private link.

Obtain a Google Cloud project ID​

  1. Open the Google Cloud Dashboard.

  2. Find the Project ID of your desire and copy its ID.

  3. Enter this ID in Google Cloud Project ID on Zilliz Cloud.

Obtain a VPC name​

Before creating a VPC endpoint, you need to have a VPC on your GCP console. To view your VPCs, do as follows:

  1. Open the Google Cloud VPC Dashboard.

  2. In the navigation pane, choose VPC networks.

  3. Find the VPC of your desire and copy its Name.

  4. Enter this name in VPC Name on Zilliz Cloud.

To create a VPC network, see Create and manage VPC networks.

Obtain a subset name​

Subnets are sub-divisions of your VPC. You need to have a subnet that resides in the same region as the private link to be created. To view your subnets, do as follows:

  1. Open your VPC network list.

  2. In the navigation pane, choose VPC networks.

  3. Click the name of the VPC of your desire.

  4. Find the subnet of your desire and copy its name.

  5. Enter this name in Subnet Name on Zilliz Cloud.

Set an endpoint prefix​

For your convenience, you are required to set an endpoint prefix in Private Service Connect Endpoint prefix so that any forwarding rules you create will have this prefix.

Obtain a private service endpoint​

Copy the command generated at the bottom of the Add Private Endpoint dialog box on Zilliz Cloud, and run this command in your GCP CloudShell to create a Private Service Connect Endpoint.

In the returned message, copy the endpoint name listed on this page.

Then, click Back to Create Private Endpoint and enter the copied name in Your Endpoint.

After verifying and accepting the preceding attributes you have submitted, Zilliz Cloud allocates a private link for this endpoint. You can view it on the details tab of your cluster.

Set up firewall rules and a DNS record​

Before you can access your cluster via the private link allocated by Zilliz Cloud, it is necessary to create a CNAME record in your DNS zone to resolve the private link to the DNS name of your VPC endpoint.

Create firewall rules​

To allow private access to your managed cluster, add appropriate firewall rules. The following snippet shows how to allow traffic through TCP port 22. Note that you need to set VPC_NAME to the name of your VPC.

VPC_NAME={{vpc-name}};

gcloud compute firewall-rules create psclab-iap-consumer --network $VPC_NAME --allow tcp:22 --source-ranges=35.235.240.0/20 --enable-logging

Create a hosted zone using Cloud DNS​

Go to Cloud DNS in your GCP console and create a DNS zone.

V0XRbvlgLoHRPexZSzEcFB5rn17

  1. Select Private in Zone type.

  2. Set Zone name to zilliz-privatelink-zone or other values that you see fit.

  3. Set DNS name to the private link obtained in step 7.

    A valid DNS name is similar to in01-xxxxxxxxxxxxxxx.gcp-us-west1.vectordb.zillizcloud.com.

  4. Select the proper VPC network in Networks.

  5. Click CREATE.

Create a record in the hosted zone​

  1. In the zone created above, click ADD STANDARD in the RECORD SETS tab.

  2. On the Create record set page, create an A record with the default settings.

    Zys4bZxploNNTex5h2OcGGwnnYd

  3. Click SELECT IP ADDRESS in IPv4 Address, and select the IP address of your endpoint.

    Uh1sbVdLSok8N6xyRMhcildDn7f

  4. Click CREATE.

Manage internet access to your clusters​

After configuring your private endpoint, you can choose to disable the cluster public endpoints to restrict internet access to your project. Once you have disabled the public endpoint, users can only connect to the cluster using the private link.

To disable public endpoints:

  1. Go to the Cluster Details page of your target cluster.

  2. Navigate to the Connection section.

  3. Click on the configurations icon next to the cluster public endpoint.

  4. Read the information and click Disable in the Disable Public Endpoint dialog box.

📘Notes

  • Private endpoints only impact data plane access. Control plane can still be accessed over the public internet.

  • After you re-enable the public endpoint, you may need to wait until the local DNS cache to expire before you can access the public endpoint.

disable_public_endpoint

Troubleshooting​

Check your DNS settings by referring to Set up firewall rules and a DNS record.

  • If the configuration is correct, when you ping your private link, you should see

    private_link_gcp_ts_01

  • If the configuration is incorrect, when you ping your private link, you may see

    private_link_gcp_ts_02