Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fintegrations%2Fgcp%2Fpsc_setup.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fintegrations%2Fgcp%2Fpsc_setup.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# Private Service Connect (PSC) for GCP

Connect your GCP workloads to Coralogix privately using Google Cloud's Private Service Connect. Traffic stays on Google's backbone network and never crosses the public internet.

## Overview[​](#overview "Direct link to Overview")

Private Service Connect (PSC) creates a private endpoint inside your VPC that routes traffic directly to Coralogix through Google's internal network. This gives you:

* **Private connectivity** — no data exposure to the public internet
* **Lower latency** — traffic stays on Google's backbone
* **No firewall rules needed** — PSC handles connectivity through Google's private fabric
* **Cross-region access** — your workloads can reach the endpoint from any region in your VPC

## Prerequisites[​](#prerequisites "Direct link to Prerequisites")

* A Google Cloud project with an existing VPC network
* Permissions to create subnets, addresses, forwarding rules, and DNS zones
* The Coralogix PSC Service Attachment URIs for your region (provided below)

## Service Attachments[​](#service-attachments "Direct link to Service Attachments")

Each Coralogix region exposes two service attachments — one for **data ingestion** (traces, metrics, logs) and one for the **management API** (queries, alerts, dashboards).

**Private Ingress** — us-central1

```
projects/coralogix-prod-saas-service/regions/us-central1/serviceAttachments/us3-psc-ingress-v1
```

**Private API** — us-central1

```
projects/coralogix-prod-saas-service/regions/us-central1/serviceAttachments/us3-psc-api-v1
```

Both use `ACCEPT_AUTOMATIC` — no approval needed from Coralogix.

***

## Step 0 — Set your variables (CLI only)[​](#step-0--set-your-variables-cli-only "Direct link to Step 0 — Set your variables (CLI only)")

If using the CLI, set these once and all later commands will reference them:

```
export PROJECT="your-gcp-project-id"

export REGION="us-central1"

export NETWORK="your-vpc-name"

export CX_DOMAIN="us3.coralogix.com"

export INGRESS_SA="projects/coralogix-prod-saas-service/regions/us-central1/serviceAttachments/us3-psc-ingress-v1"

export API_SA="projects/coralogix-prod-saas-service/regions/us-central1/serviceAttachments/us3-psc-api-v1"
```

***

## Step 1 — Create the PSC subnet[​](#step-1--create-the-psc-subnet "Direct link to Step 1 — Create the PSC subnet")

A single subnet in the same region as the Coralogix service attachments. GCP uses it to allocate IPs for your PSC endpoints.

> Make sure the CIDR range doesn't overlap with existing subnets in your VPC.

### Console UI[​](#console-ui "Direct link to Console UI")

1. Go to **VPC network** → **VPC networks** → **Your network** → **Subnets** → **Add subnet**

2. Fill in:

   <!-- -->

   * **Name:** `cx-psc-subnet`
   * **Region:** `us-central1` (must match the service attachment region)
   * **Purpose:** Leave as **None** (regular subnet)
   * **IP range:** `10.100.16.0/28`

3. Click **Add**

### gcloud CLI[​](#gcloud-cli "Direct link to gcloud CLI")

```
gcloud compute networks subnets create cx-psc-subnet \

  --project=$PROJECT --network=$NETWORK --region=$REGION \

  --range=10.100.16.0/28
```

***

## Step 2 — Create PSC endpoints[​](#step-2--create-psc-endpoints "Direct link to Step 2 — Create PSC endpoints")

These forwarding rules establish the private connections to Coralogix. GCP auto-allocates an IP from the subnet for each endpoint.

### Console UI[​](#console-ui-1 "Direct link to Console UI")

1. Go to **Network Services** → **Private Service Connect** → **Connected endpoints** → **+ Connect endpoint**

2. Create the **ingress** endpoint:

   * **Target:** Select **Published service**

   * **Target service:** Paste the following URI:

     ```
     projects/coralogix-prod-saas-service/regions/us-central1/serviceAttachments/us3-psc-ingress-v1
     ```

   * **Endpoint name:** `psc-coralogix-ingress`

   * **Network:** \<Your Network>

   * **Subnetwork:** `cx-psc-subnet`

   * **IP address:** Select **Create IP address** → name it `cx-psc-ingress-ip` → **Reserve**

   * **Enable global access:** Check this box

3. Click **Add endpoint**

4. Create the **API** endpoint:

   * **Target:** Select **Published service**

   * **Service attachment:** Paste the following URI:

     ```
     projects/coralogix-prod-saas-service/regions/us-central1/serviceAttachments/us3-psc-api-v1
     ```

   * **Endpoint name:** `psc-coralogix-api`

   * **Network:** Your VPC

   * **Subnetwork:** `cx-psc-subnet`

   * **IP address:** Select **Create IP address** → Name it `cx-psc-api-ip` → **Reserve**

   * **Enable global access:** Check this box

5. Click **Add endpoint**

6. Verify both endpoints show **Accepted** status

7. Record the two IP addresses — you'll need them for DNS

### gcloud CLI[​](#gcloud-cli-1 "Direct link to gcloud CLI")

```
gcloud compute addresses create psc-ingress-ip \

  --project=$PROJECT --region=$REGION --subnet=cx-psc-subnet



gcloud compute addresses create psc-api-ip \

  --project=$PROJECT --region=$REGION --subnet=cx-psc-subnet



gcloud compute forwarding-rules create psc-coralogix-ingress \

  --project=$PROJECT --region=$REGION --network=$NETWORK \

  --address=psc-ingress-ip \

  --target-service-attachment=$INGRESS_SA \

  --allow-psc-global-access



gcloud compute forwarding-rules create psc-coralogix-api \

  --project=$PROJECT --region=$REGION --network=$NETWORK \

  --address=psc-api-ip \

  --target-service-attachment=$API_SA \

  --allow-psc-global-access
```

**Verify:**

```
gcloud compute forwarding-rules describe psc-coralogix-ingress \

  --project=$PROJECT --region=$REGION --format='table(name, IPAddress, pscConnectionStatus)'



gcloud compute forwarding-rules describe psc-coralogix-api \

  --project=$PROJECT --region=$REGION --format='table(name, IPAddress, pscConnectionStatus)'
```

Both should show `ACCEPTED`. Record the IPs for the next step:

```
INGRESS_IP=$(gcloud compute forwarding-rules describe psc-coralogix-ingress \

  --project=$PROJECT --region=$REGION --format='value(IPAddress)')

API_IP=$(gcloud compute forwarding-rules describe psc-coralogix-api \

  --project=$PROJECT --region=$REGION --format='value(IPAddress)')



echo "Ingress IP: $INGRESS_IP"

echo "API IP:     $API_IP"
```

***

## Step 3 — Create Cloud DNS private zone and records[​](#step-3--create-cloud-dns-private-zone-and-records "Direct link to Step 3 — Create Cloud DNS private zone and records")

A private DNS zone so your workloads resolve `*.private.us3.coralogix.com` to the PSC endpoint IPs.

### Console UI[​](#console-ui-2 "Direct link to Console UI")

1. Go to **Network Services** → **Cloud DNS** → **Create zone**

2. Fill in:

   <!-- -->

   * **Zone type:** Private
   * **Zone name:** `private-coralogix`
   * **DNS name:** `private.us3.coralogix.com`
   * **Networks:** Select your VPC

3. Click **Create**

4. Inside the zone, click **Add standard**

5. Create the **ingress** record:

   <!-- -->

   * **DNS name:** `ingress.private.us3.coralogix.com`
   * **Type:** A
   * **TTL:** 300
   * **IP address:** The ingress endpoint IP from Step 2

6. Click **Create**

7. Create the **API** record:

   <!-- -->

   * **DNS name:** `api.private.us3.coralogix.com`
   * **Type:** A
   * **TTL:** 300
   * **IP address:** The API endpoint IP from Step 2

8. Click **Create**

### gcloud CLI[​](#gcloud-cli-2 "Direct link to gcloud CLI")

```
gcloud dns managed-zones create private-coralogix \

  --project=$PROJECT \

  --dns-name="private.${CX_DOMAIN}." \

  --description="Coralogix PSC private DNS" \

  --visibility=private --networks=$NETWORK



gcloud dns record-sets create "ingress.private.${CX_DOMAIN}." \

  --project=$PROJECT --zone=private-coralogix \

  --type=A --ttl=300 --rrdatas=$INGRESS_IP



gcloud dns record-sets create "api.private.${CX_DOMAIN}." \

  --project=$PROJECT --zone=private-coralogix \

  --type=A --ttl=300 --rrdatas=$API_IP
```

***

## Verification[​](#verification "Direct link to Verification")

Run these from a VM or GKE pod inside your VPC.

### DNS resolution[​](#dns-resolution "Direct link to DNS resolution")

```
nslookup ingress.private.us3.coralogix.com
```

Expected output:

```
Server:    10.102.0.10

Address:   10.102.0.10:53



Name:      ingress.private.us3.coralogix.com

Address:   10.100.17.2          ← your PSC ingress IP
```

```
nslookup api.private.us3.coralogix.com
```

Expected output:

```
Server:    10.102.0.10

Address:   10.102.0.10:53



Name:      api.private.us3.coralogix.com

Address:   10.100.17.3          ← your PSC API IP
```

### TCP connectivity (telnet)[​](#tcp-connectivity-telnet "Direct link to TCP connectivity (telnet)")

```
telnet ingress.private.us3.coralogix.com 443
```

Expected output:

```
Connected to ingress.private.us3.coralogix.com
```

Press `Ctrl+]` then type `quit` to exit.

### TLS handshake (curl verbose)[​](#tls-handshake-curl-verbose "Direct link to TLS handshake (curl verbose)")

```
curl -sv --connect-timeout 5 https://ingress.private.us3.coralogix.com 2>&1 | head -20
```

Expected output:

```
* Host ingress.private.us3.coralogix.com:443 was resolved.

* IPv4: 10.100.17.2             ← private IP, not public

*   Trying 10.100.17.2:443...

* Connected to ingress.private.us3.coralogix.com (10.100.17.2) port 443

* TLSv1.3 (OUT), TLS handshake, Client hello (1):

* TLSv1.3 (IN), TLS handshake, Server hello (2):

* TLSv1.3 (IN), TLS handshake, Certificate (11):

* TLSv1.3 (IN), TLS handshake, CERT verify (15):

* TLSv1.3 (IN), TLS handshake, Finished (20):

* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384

* Server certificate:

*  subject: CN=*.us3.coralogix.com

*  subjectAltName: host "ingress.private.us3.coralogix.com" matched cert's "*.private.us3.coralogix.com"

*  SSL certificate verify ok.
```

Key things to confirm: the IP is **private** (not public), TLS handshake **completed**, and the certificate **matched**.

### Connection timing (curl)[​](#connection-timing-curl "Direct link to Connection timing (curl)")

```
curl -sk --connect-timeout 5 -o /dev/null \

  -w "tcp:%{time_connect} tls:%{time_appconnect}\n" \

  https://ingress.private.us3.coralogix.com
```

Expected output:

```
tcp:0.041413 tls:0.083697
```

Both values should be very low (under 100ms) since traffic stays on Google's backbone.

### From a GKE pod[​](#from-a-gke-pod "Direct link to From a GKE pod")

If you don't have a VM, you can run any of the above from a temporary pod:

```
kubectl run test --rm -it --restart=Never --image=curlimages/curl:8.5.0 \

  -- curl -sv --connect-timeout 5 https://ingress.private.us3.coralogix.com 2>&1 | head -20
```

Expected output is the same as the TLS handshake test above.

***

## Using the private endpoints[​](#using-the-private-endpoints "Direct link to Using the private endpoints")

Once verified, configure your telemetry pipelines to use the private endpoints:

**OTLP gRPC (traces, metrics, logs)**

* Public: `ingress.us3.coralogix.com:443`
* Private: `ingress.private.us3.coralogix.com:443`

**OTLP HTTP**

* Public: `https://ingress.us3.coralogix.com`
* Private: `https://ingress.private.us3.coralogix.com`

**Fluent Bit / log ingestion**

* Public: `ingress.us3.coralogix.com`
* Private: `ingress.private.us3.coralogix.com`

**REST API / DataPrime queries**

* Public: `api.us3.coralogix.com`
* Private: `api.private.us3.coralogix.com`

No other changes are needed — TLS works the same way, and the Coralogix certificates are valid for the private DNS names.

***

## Cleanup[​](#cleanup "Direct link to Cleanup")

To remove all PSC resources:

### Console UI[​](#console-ui-3 "Direct link to Console UI")

Delete in reverse order: DNS records → DNS zone → Forwarding rules → Static IPs → Subnet.

### gcloud CLI[​](#gcloud-cli-3 "Direct link to gcloud CLI")

```
# Delete forwarding rules

gcloud compute forwarding-rules delete psc-coralogix-ingress \

  --project=$PROJECT --region=$REGION --quiet

gcloud compute forwarding-rules delete psc-coralogix-api \

  --project=$PROJECT --region=$REGION --quiet



# Delete static IPs

gcloud compute addresses delete psc-ingress-ip \

  --project=$PROJECT --region=$REGION --quiet

gcloud compute addresses delete psc-api-ip \

  --project=$PROJECT --region=$REGION --quiet



# Delete DNS records and zone

gcloud dns record-sets delete "ingress.private.${CX_DOMAIN}." \

  --project=$PROJECT --zone=private-coralogix --type=A

gcloud dns record-sets delete "api.private.${CX_DOMAIN}." \

  --project=$PROJECT --zone=private-coralogix --type=A

gcloud dns managed-zones delete private-coralogix \

  --project=$PROJECT --quiet



# Delete subnet

gcloud compute networks subnets delete cx-psc-subnet \

  --project=$PROJECT --region=$REGION --quiet
```