# Terraform add-on: GCP Private Service Connect Generated reference for the GCP Private Service Connect add-on module. ### Requirements | Name | Version | | ---- | ------- | | terraform | >= 1.14 | | google | ~> 7.42.0 | ### Providers | Name | Version | | ---- | ------- | | google.consumer | 7.42.0 | | google.producer | 7.42.0 | ### Resources | Name | Type | | ---- | ---- | | [google\_compute\_address.consumer](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_address) | resource | | [google\_compute\_forwarding\_rule.consumer](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_forwarding_rule) | resource | | [google\_compute\_service\_attachment.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_service_attachment) | resource | | [google\_compute\_subnetwork.psc\_nat](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_subnetwork) | resource | | [google\_dns\_managed\_zone.consumer](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/dns_managed_zone) | resource | | [google\_dns\_record\_set.consumer](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/dns_record_set) | resource | ### Inputs | Name | Description | Type | Default | Required | | ---- | ----------- | ---- | ------- | :------: | | name | Name prefix for every PSC resource this module creates (e.g. "crypto-vault-nats-hub-to-spoke-0"). Must comply with RFC1035 (1-63 chars, lowercase leading letter) because it seeds the NAT subnet, service-attachment, reserved-address, forwarding-rule and DNS-zone names; suffixes added by the module (-psc-nat, -sa, -psc-ip, -psc-ep, -psc-zone) count toward the 63-char limit. | `string` | n/a | yes | | consumer\_side | Consumer side — the cluster/project DIALING IN to a published service (typically a spoke for NATS, or the hub for a spoke's key-store/policy-server). Set to null to skip the consumer entirely (a producer-only invocation that just publishes the attachment). `network`/`subnetwork` are the consumer VPC + subnet self\_links where the PSC endpoint's reserved internal IP lands; `ip_address` pins a specific IP (null auto-allocates from the subnet). `target_service_attachment` is the service-attachment self\_link to attach to — leave null to consume the attachment this same module created via producer\_side, or set it to a prior invocation's `service_attachment_self_link` output for a fan-out consumer. A PSC endpoint MUST be created in the same region as its target service attachment; this module validates `region` against either producer\_side or the `/regions//` segment of the explicit self-link. `allow_global_access` only lets clients in other regions reach that same-region endpoint; it does not make endpoint-to-attachment targeting cross-region. `dns_zone`, when set, creates a Cloud DNS PRIVATE zone + A record so the confidential node's in-node resolver can resolve the endpoint name to the reserved IP (the reason NLB DNS is mandatory on AWS); `record_name` is the FQDN (dot-terminated, inside `dns_name`) and `networks` are the VPC self\_links authorised to query the zone. | 
object(\{
    network                   = string
    subnetwork                = string
    region                    = string
    ip\_address                = optional(string, null)
    target\_service\_attachment = optional(string, null)
    allow\_global\_access       = optional(bool, true)
    dns\_zone = optional(object(\{
      dns\_name    = string
      record\_name = string
      networks    = list(string)
      ttl         = optional(number, 300)
    }), null)
  })
| `null` | no | | labels | Extra labels merged onto every PSC resource that supports labels (reserved address, consumer forwarding rule, Cloud DNS zone). GCP label keys/values must be lowercase and may contain hyphens/underscores. Note: google\_compute\_service\_attachment and google\_compute\_subnetwork do NOT support labels, so they carry none. | `map(string)` | `{}` | no | | producer\_side | Producer side — the cluster/project that PUBLISHES a service (typically the hub for NATS, or a spoke for its own key-store/policy-server). Set to null to skip the producer entirely (a consumer-only fan-out invocation, in which case consumer\_side.target\_service\_attachment must point at a service attachment created elsewhere). `target_service` is the self\_link/id of the producer's internal-load-balancer forwarding rule; pass it explicitly so this helper is not coupled to whether GKE or Terraform created the load balancer. `network` is the producer VPC self\_link that hosts the dedicated PSC NAT subnet. `nat_subnet_cidr` is a FRESH, non-overlapping range reserved for PSC NAT (it must not collide with the GKE nodes/pods/services ranges). `connection_preference` = ACCEPT\_AUTOMATIC opens the attachment to anyone; ACCEPT\_MANUAL restricts it to `consumer_accept_lists` (project id-or-number + per-project forwarding-rule limit). `domain_names` (max 1, must end in a dot) drives GCP's optional endpoint auto-DNS — leave null and use the module's Cloud DNS zone instead. | 
object(\{
    target\_service        = string
    network               = string
    region                = string
    nat\_subnet\_cidr       = string
    connection\_preference = optional(string, "ACCEPT\_MANUAL")
    enable\_proxy\_protocol = optional(bool, false)
    consumer\_accept\_lists = optional(list(object(\{
      project\_id\_or\_num = string
      connection\_limit  = optional(number, 10)
    })), \[])
    consumer\_reject\_lists = optional(list(string), \[])
    domain\_names          = optional(list(string), null)
    reconcile\_connections = optional(bool, null)
  })
| `null` | no | ### Outputs | Name | Description | | ---- | ----------- | | consumer\_endpoint\_dns\_name | The fully-qualified DNS name that resolves (via the module-managed Cloud DNS private zone) to the consumer endpoint IP — prefer this over the raw IP when building service URLs so the confidential node's in-node resolver can reach the peer. Null when the optional dns\_zone block was not supplied. | | consumer\_endpoint\_ip | The reserved internal IP of the consumer PSC endpoint — the stable address peers dial (e.g. nats://\:4222, http://\:80). Feeds the remote\_mpc\_key\_stores / remote\_policy\_servers addresses in the terraform/gcp locals. Null when no consumer side was created. | | consumer\_forwarding\_rule\_self\_link | Self-link of the consumer PSC forwarding rule (the endpoint), or null when no consumer side was created. | | nat\_subnet\_self\_link | Self-link of the dedicated PRIVATE\_SERVICE\_CONNECT NAT subnet on the producer VPC, or null when no producer side was created. Useful for firewall/route debugging. | | service\_attachment\_id | Resource id (projects/\

/regions/\/serviceAttachments/\) of the producer service attachment, or null when no producer side was created. | | service\_attachment\_self\_link | Self-link of the producer service attachment. Pass this as consumer\_side.target\_service\_attachment to a second, consumer-only invocation that adds another consumer endpoint to the same published service (the hub-NATS fan-out). Null when this invocation didn't create a producer side. |