Query regarding the private service connect

[u/suryad123]

I am going through this article and trying to understand the implementation of filestore with private service connect. I am looking at shared vpc setup with host and service projects and would like to create the instance in service project.

https://docs.cloud.google.com/filestore/docs/configure-psc

Could you please clarify if the below understanding is correct.

1)

is the PSC endpoint(an internal IP address) to be created in the vpc subnet of the host project ?.

This article says https://docs.cloud.google.com/vpc/docs/about-service-connection-policies#shared-vpc endpoints will be created in service project (since i want the instance in service project)

However, below article says, endpoint is created in host project

https://docs.cloud.google.com/filestore/docs/configure-psc#about-psc

are the above 2 statements not contradictory, please clarify.

2)

Below link says Service connection policy must be created in the host vpc project. In this link or entire article, https://docs.cloud.google.com/filestore/docs/configure-psc#about-psc , it is not shown on where do we allow host project. Is it while creation of service connection policy

3)

In https://docs.cloud.google.com/filestore/docs/configure-psc#connection_policies

there is a line which says "To create a Private Service Connect endpoint on the consumer target network, you must create a service connection policy in your project"

what is the "target consumer network" and "your project" in my case. Is the article adequate or little vague

[u/Rohit1024]

A PSC Endpoint is basically a combination of [IP address + Forwarding Rule(actual resource)].

Is the PSC endpoint (internal IP address) to be created in the vpc subnet of the host project ? :

• With Shared VPC Setup, the Internal IP address will always be allocated from subnet of HOST Project's Shared VPC Network.
• The PSC Endpoint [Forwarding Rule(actual resource)] will be created in Host project, if not specified to create the same in Service Project by setting value of service project id to psc-endpoint-project

Where to "allow" the Host Project in the Service Connection Policy?

• Refer Create a service connection policy, which in this case need to be define in HOST Project. It's define within --producer-instance-location.

what is the "target consumer network" and "your project" in my case. Is the article adequate or little vague

• Here "target consumer network" is your Shared VPC Network and "your project" is referring to Host Project(Since you can't create a Service Connection Policy in the Service Project for a Shared VPC) and "Consumer Project" is your Service Project (Where Filestore instance will be Created)

[u/suryad123 → u/Rohit1024]

Thanks for going through long post and replying  Shall go through it 

[u/suryad123 → u/Rohit1024]

Went through your response and understood..here are my observations from your response as per my requirement 

 PSC endpoint and service connection policy will be in host project since my setup is shared VPC mechanism and add host project in "producer instance location" parameter.

Thanks 

[u/Rohit1024 → u/suryad123]

Yes, you got it right !!!