Ground to Cloud enablement through PSC (private service connect) or PGA (private google access) through an interconnect or VPN for private GCP API access - customer procedure using AWS as simulated groud

See partner interconnect procedure (any BGP will do - vpn, partner interconnect, direct interconnect, peering)
- https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/298

Architecture

20230827:2300: pivot to PSC from PGA
https://cloud.google.com/vpc/docs/about-accessing-vpc-hosted-services-endpoints

https://cloud.google.com/vpc/docs/configure-private-service-connect-apis

Document and simulate GCP + Customer procedure:
Shadow
https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/issues/299
Follow
https://cloud.google.com/vpc/docs/private-access-options

Architecture Discussion:
- PSC allows for service as opposed to network level API access. Where peering is a broad many-ti-many connection - PSC is a many-to-one connectivity architecture that allows for granular control
- PSC forwarding rules or load balancer
- Reasons for PSC over PGA only
- Client app requirements/constraints
- Can the on-prem client use custom DNS names like storage-xyy.p.googleapis.com or we revert to the default storage.googleapis.com
- advertise either route above as a custom route on the gcp router
- determine if on GCP apps need PSC access as well - implications to peering, multiple subnets
- review slide 29 of https://docs.google.com/presentation/d/13sjT2tJ4yLIYGRREE3wBrylB1OvcEMpKdquVuJB_nX4/edit?resourcekey=0-N3DruQaiutFvZ98HTT7-vQ#slide=id.g1154b3b950f_2_3152
- Client needs a non-krm/terraform dev env to test out gcloud/console creation of services before IaC dev
- align the simulated GCP/AWS hybrid environment to the on-prem env
- finish DNS forwarding to on-prem DNS forwarding IPs - need IPs for AWS Route53 to simulate
Requirements
- Full end-end non-GCP to GCP private connection where GCP APIs are available privately.
- We will use a HA VPN connection with BGP routing between AWS (on/prem/ground) and GCP
- bidirectional route propagation is working
- bidirectional private zone DNS is working
- PGA Private Google Access is working through private.googleapis.com (199.36.153.8/30) routing through the VPN from AWS(prem)

- nonprod/prod - use different endpoints
- add datafusion service anablement

Asset Inventory - GCP side
- Add static route to the BGP router (VPN or interconnect) - for the PGA CIDR (199.36.153.8/30 range: 199.36.153.8, 199.36.153.9, 199.36.153.10, and 199.36.153.11.) - so the on prem router can propagate private.googleapis.com calls through the BGP tunnels instead of their Internet Gateway
-

Notes:

https://docs.google.com/presentation/d/13sjT2tJ4yLIYGRREE3wBrylB1OvcEMpKdquVuJB_nX4/edit?resourcekey=0-N3DruQaiutFvZ98HTT7-vQ#slide=id.g1154b3b950f_2_3458
slide 27
https://cloud.google.com/vpc/docs/configure-private-google-access-hybrid
https://cloud.google.com/vpc/docs/configure-private-service-connect-apis#on-premises

Customer environment consists of already created interconnect/VPN where there is a BGP route for the DNS proxy egress from onprem
Use case is one where google APIs and googledomains.com queries into GCP both resolve and are kept private on the premium google network

https://cloud.google.com/vpc/docs/private-service-connect#:~:text=Similarly%2C%20a%20Private%20Service%20Connect,internal%20IP%20addresses%20for%20endpoints.

Reference: procedures
- https://cloud.google.com/network-connectivity/docs/vpn/tutorials/create-ha-vpn-connections-google-cloud-aws
- https://medium.com/google-cloud/private-access-options-for-services-in-gcp-7d5c8b298817#:~:text=Conclusion%3A%20Private%20Google%20Access%20is,your%20own%20internal%20IP%20addresses
- https://cloud.google.com/vpc/docs/configure-private-service-connect-apis#create-endpoint
- https://chou.se/configuring-private-google-access/

See https://github.com/GoogleCloudPlatform/k8s-config-connector/issues/763