Create a Filestore instance with Private Service Connect

The following guide shows you how to configure your Filestore instances to use Private Service Connect with NFSv3 or NFSv4.1 file system protocols.

About Private Service Connect

Private Service Connect allows consumers to access managed services privately from inside their VPC network. Private Service Connect requires the consumer to provision a single internal IP address in its own Virtual Private Cloud to create a Private Service Connect endpoint, instead of allocating an entire IP address range to facilitate the connection. This single IP address is all that's required from the consumer's IP space to access the Filestore instance.

For shared Shared VPC configurations, where the Private Service Connect endpoint is provisioned in the VPC host project, the service connection policy scope must allow the host project.

Connection policies

To create a Private Service Connect endpoint on the consumer target network, you must create a service connection policy in your project. Creating such a connection policy allows separating the permissions for creating a Filestore instance and allocating networking resources, such as Private Service Connect resources and IP addresses for them. Creating a service connection policy enables the automatic creation of an endpoint in the subnet with a private IP address.

Create a Filestore instance that uses Private Service Connect

Create a Filestore instance that uses Private Service Connect for network connections.

Before you begin

  1. Verify if you have enough quota. Instance quota ranges by the region location and service tier you want to use. To increase available quota, you must submit a quota increase request.

  2. Ensure you have enabled the following APIs:

Create a Filestore instance

Create a Filestore instance using Google Cloud console or Google Cloud CLI.

Google Cloud console

  1. In the Google Cloud console, go to the Filestore Instances page.

    Go to Instances

  2. Click Create instance.

  3. Specify the basic parameters of the instance:

    • In the Instance ID field, type the name you want to use for your Filestore instance.

    • For Instance type, select Regional or Zonal service tier.

      To create an enterprise instance, you must use Filestore API or Google Cloud CLI.

    • For Capacity, first select the capacity range, and then enter the capacity you want to use. You must use a value between 1 TB and 10 TB, in increments of 256 GiB (0.25 TiB).

    • For Region, use the list to select the region you want to deploy your instance in.

    • For Protocol, select NFSv3 or NFSv4.1, depending on the network protocol you want to use.

    • For Network IP stack type select IPv4 or IPv6. Filestore with Private Service Connect IPv6 support lets you choose either an IPv4 or IPv6 endpoint per service attachment. If you select IPv6 and you also want to configure access control, the IP address or range field will be validated for IPv6 CIDR notation.

    • In the VPC Network field, select the network you want to use for the Filestore instance and NFS clients. The selected network must have a valid service connection policy to connect with the instance using Private Service Connect. If such a policy doesn't exist, you must create one. Use the following instructions to create a policy.

      How to create a service connection policy

      When creating a Filestore instance you must either use a VPC network that already has a connection policy in place or create the connection policy as part of the instance creation workflow. This section explains how to create a service connection policy for the VPC network.

      1. In VPC Network, select the network. If the connection policy doesn't exist for the selected network, click Create service connection policy.
      2. In the Policy name field, add the name for the service connection policy.
      3. Optional: In the Description field provide a short description of your policy.
      4. The Source service scope and Target endpoints scope fields are populated with information you provided when creating the instance.
      5. In the Subnetworks field, select subnets used for the Filestore service endpoints. Subnets are IP address ranges the services can use to access the Filestore instance. For more information on using subnets with Private Service Connect, see Purposes of subnets
      6. Optional: In the Connection limit field, The limit determines how many endpoints can be created by using this connection policy. If omitted, there is no limit.
      7. Click Create policy to finish. Continue to create the instance or review your policy in Private Service Connect.

    • In the File share name field, enter the name of the NFS file share that is served from the instance.

  4. Click Create to create the instance.

gcloud

  1. If you already have the gcloud CLI installed, you can update it: