gcloud compute service-attachments create - create a Google Compute Engine service attachment

gcloud compute service-attachments createNAME--nat-subnets=NAT_SUBNETS,[NAT_SUBNETS,…](--producer-forwarding-rule=PRODUCER_FORWARDING_RULE    |--target-service=TARGET_SERVICE)[--connection-preference=CONNECTION_PREFERENCE; default="ACCEPT_AUTOMATIC"][--consumer-accept-list=[PROJECT_OR_NETWORK=LIMIT,…]][--consumer-reject-list=[REJECT_LIST,…]][--description=DESCRIPTION][--domain-names=[DOMAIN_NAMES,…]][--enable-proxy-protocol][--nat-subnets-region=NAT_SUBNETS_REGION][--propagated-connection-limit=PROPAGATED_CONNECTION_LIMIT][--reconcile-connections][--region=REGION][--global-producer-forwarding-rule    |--producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION][GCLOUD_WIDE_FLAG …]

gcloudcomputeservice-attachmentscreateSERVICE_ATTACHMENT_NAME--region=us-central1--producer-forwarding-rule=MY_ILB--connection-preference=ACCEPT_AUTOMATIC--nat-subnets=MY_SUBNET1,MY_SUBNET2

To create a service attachment with a textual description, run:

gcloudcomputeservice-attachmentscreateSERVICE_ATTACHMENT_NAME--region=us-central1--producer-forwarding-rule=MY_ILB--connection-preference=ACCEPT_AUTOMATIC--nat-subnets=MY_SUBNET1,MY_SUBNET2--description='default service attachment'

NAME

Name of the service attachment to create.

--nat-subnets=NAT_SUBNETS,[NAT_SUBNETS,…]

The subnetworks provided by service producer to use for NAT

Exactly one of these must be specified:

--producer-forwarding-rule=PRODUCER_FORWARDING_RULE

Target forwarding rule that receives forwarded traffic.

--target-service=TARGET_SERVICE

URL of the target service that receives forwarded traffic.

--connection-preference=CONNECTION_PREFERENCE; default="ACCEPT_AUTOMATIC"

This defines the service attachment's connection preference.CONNECTION_PREFERENCE must be one of:

ACCEPT_AUTOMATIC

Always accept connection requests from consumers automatically.

ACCEPT_MANUAL

Only accept connection requests from consumers with the approval of the serviceprovider.

--consumer-accept-list=[PROJECT_OR_NETWORK=LIMIT,…]

Specifies which consumer projects or networks are allowed to connect to theservice attachment. Each project or network has a connection limit. A givenservice attachment can manage connections at either the project or networklevel. Therefore, both the accept and reject lists for a given serviceattachment must contain either only projects or only networks.

For example,--consumer-accept-list myProjectId1=20 accepts aconsumer project myProjectId1 with connection limit 20;--consumer-accept-listprojects/myProjectId1/global/networks/myNet1=20 accepts a consumernetwork myNet1 with connection limit 20

• PROJECT_OR_NETWORK - Consumer project ID, project number or networkURL.
• CONNECTION_LIMIT - The maximum number of allowed connections.

--consumer-reject-list=[REJECT_LIST,…]

Specifies a comma separated list of projects or networks that are not allowed toconnect to this service attachment. The project can be specified using itsproject ID or project number and the network can be specified using its URL. Agiven service attachment can manage connections at either the project or networklevel. Therefore, both the reject and accept lists for a given serviceattachment must contain either only projects or only networks.

--description=DESCRIPTION

An optional, textual description for the service attachment.

--domain-names=[DOMAIN_NAMES,…]

Specifies a comma separated list of DNS domain names that are used during DNSintegration on PSC connected endpoints.

--enable-proxy-protocol

If True, then enable the proxy protocol which is for supplying client TCP/IPaddress data in TCP connections that traverse proxies on their way todestination servers.

--nat-subnets-region=NAT_SUBNETS_REGION

Region of the subnetworks to operate on. If not specified, it will be set to theregion of the service attachment. Overrides the defaultcompute/region property value for this command invocation.

--propagated-connection-limit=PROPAGATED_CONNECTION_LIMIT

The number of consumer spokes that connected Private Service Connect endpointscan be propagated to through Network Connectivity Center. This limit lets theservice producer limit how many propagated Private Service Connect connectionscan be established to this service attachment from a single consumer.

If the connection preference of the service attachment is ACCEPT_MANUAL, thelimit applies to each project or network that is listed in the consumer acceptlist. If the connection preference of the service attachment isACCEPT_AUTOMATIC, the limit applies to each project that contains a connectedendpoint.

If unspecified, the default propagated connection limit is 250.

--reconcile-connections

Determines whether to apply changes to consumer accept or reject lists toexisting connections or only to new connections.

If false, existing endpoints with a connection status of ACCEPTED or REJECTEDare not updated.

If true, existing endpoints with a connection status of ACCEPTED or REJECTED areupdated based on the connection policy update. For example, if a project ornetwork is removed from the --consumer-accept-list and added to--consumer-reject-list, all the endpoints in that project or network with theACCEPTED state are set to REJECTED.

--region=REGION

Region of the service attachment to create. If not specified, you might beprompted to select a region (interactive mode only).

To avoid prompting when this flag is omitted, you can set thecompute/region property:

gcloudconfigsetcompute/regionREGION

A list of regions can be fetched by running:

gcloudcomputeregionslist

To unset the property, run:

gcloudconfigunsetcompute/region

Alternatively, the region can be stored in the environment variableCLOUDSDK_COMPUTE_REGION.

At most one of these can be specified:

--global-producer-forwarding-rule

If set, the forwarding rule is global.

--producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION

Region of the forwarding rule to operate on. If not specified, you might beprompted to select a region (interactive mode only).

To avoid prompting when this flag is omitted, you can set thecompute/region property:

gcloudconfigsetcompute/regionREGION

A list of regions can be fetched by running:

gcloudcomputeregionslist

To unset the property, run:

gcloudconfigunsetcompute/region

Alternatively, the region can be stored in the environment variableCLOUDSDK_COMPUTE_REGION.

Run$gcloud help for details.