Humanity is the quality that we lack so much in real life, An Abide leaner, Cloud Architect⛅️, Love DevOps, AWS Community Builder 2023, GDE 2024, Proud Hindu 🕉️
Great video! But I have a question. What does PSC use to communicate? PSC NAT? Or PSC reserve network ? Or is that one and the same? There is so confusing documentation on Google for this. Please help
You can think of PSC as private reserved resources becoz behind the scene it’s an ENI which takes your request privately in Google network to consume other services which is in different network.. Think of Private Service Connect as a VIP express lane that takes you directly from the airport to your terminal, bypassing the usual routes and ensuring a secure and efficient communication
@@thecloudbaba8668 thanks. So with that being said, what IP does PSC require to communicate with attachments and the wider network ? I thought it was using its own Nat range?
finally someone who showed the procedure properly :) how do you setup vpn access to cloud sql? 🤔GCP likes to run those in their own VPC and so I have VPN connectivity but when I try to hit cloud sql from another project nothing happens, there has to be some sort of route that we have to make manually
Private service connect is the solution.you don’t need to setup any vpn or something becoz cloud sql is owned by Google Cloud Vpc. Refer the following url cloud.google.com/sql/docs/mysql/configure-private-service-connect
@@thecloudbaba8668 actually you do need VPN, it's from VPC to VPC (project to project) and therefore you do need VPN. I was able to se it up and my mistake had been that my subnets were regional as oppose to global so the cloud router was only advertising regional routes to one another. Once I made both subnets global VPN created the routes
@@thecloudbaba8668 actually you do NEED VPN, the question is how you can get from one vpc to another (project to project) and gcp hosts your SQL and peers your VPC to that SQL endpoint but the other project's VPC can't get to this even if it's peered. The mistake I made was that the VPCs I created had a regional Routing Mode instead of Global. Once I set both VPCs to Global Routing, the HA VPN connection added the routes and I could get to the SQL endpoint from the other VPC
sir. do you know which role/permissions are required for creating the NEG ? i got the error when trying to create NEG in terraform Error: Error creating RegionNetworkEndpointGroup: googleapi: Error 403: Required 'compute.regionNetworkEndpointGroups.create' permission for 'projects/woo-pick-inventory/regions/us-central1/networkEndpointGroups/woopick-backend-cloudrun-neg-us', forbidden btw. great video series!
Well, the permission which you are looking for is in the error :) see carefully in the error. It’s starts with compute.regionNetwork…….. Alternatively you can give wider role like network Adminn for simplicity Hope it helps!
Sir, I wanted to know about PROXY_PASS and upstream_server . How does this work . Is forwarding rule is PROXY_PASS ?? And backend server are instance group?
Hi, you have created very detailed demo of AWS Directory service, however there is voice echo after 16th minute which goes on for quite sometime and is very disturbing.
Understand the logic. You can ask Gemini to explain any logs that you want to read.. this particular log is about checking my impersonator service account to verify that whether it’s creating my resources or not.. hope it helps!
Congratulations for sharing, this helps a lot, hundreds of materials explain in key terms what is very insecure. One question, don't you need to log in with gcloud before running terraform? Just setting the service account will Terraform take care of this under the hood?
But understand what it looks like in automation in a real environment, why did you do this on your machine. But it's not ideal, right? what is the solution?
It’s an ideal approach. When you run gclouud auth login, you get authenticated using password and MFA. This approach is secure from the key-based approach. Hope it make sense
@@thecloudbaba8668 So this is good for you to run on your machine, right? because in an automation to use terraform this wouldn't be the best method, would it?
This should work for the below case. 2 Diff Projects, 2 diff. network, 2 Jenkins,1 Windows JH - from the JH needs to access both Jenkins via private IP for that needs to networking. For networking, I am looking for another option like VPC peering and PSC, Can you please let me PSC will work in this use case.
Thanks@@thecloudbaba8668 i would like to create private uptime check for the applications which are running on GCP VM and GKE clusters with internal IP only.
@@thecloudbaba8668 i figured out the problem yesterday. I was missing the vpc2 to vpc1 resource block code. I had just written code block to peer vpc1 to vpc2. Post i applied vpc2 to vpc1 peering block it changed to active immediately from inactive state.thanks