Configure Private Service Connect interface for a pipeline

You can configure private connectivity for your pipeline run using aPrivate Service Connect interface. Google recommends usingVertex AI Private Service Connect for private connectivity,since it reduces the chances of IP exhaustion and supports transitive peering.

Vertex AI Pipelines uses the underlyingPrivate Service Connect interface infrastructure for trainingto pass the connection details to the custom training job. To learn more aboutthe limitations and pricing of usingPrivate Service Connect interfaces with custom training, seeUse Private Service Connect interface for Vertex AI Training.

Limitations

Private Service Connect interfaces don't supportexternal IP addresses.

Pricing

Pricing for Private Service Connect interfaces is described on theAll networking pricing page.

Before you begin

To use a Private Service Connect interface withVertex AI Pipelines, you must firstSet up a Private Service Connect interface for Vertex AI resources.

Create a pipeline run with Private Service Connect interfaces

To create a pipeline run, you must first create a pipeline spec. A pipeline specis an in-memory object that you create by converting a compiled pipelinedefinition.

Create a pipeline spec

Follow these instructions to create an in-memory pipeline spec that you can useto create the pipeline run:

  1. Define a pipeline and compile it into a YAML file. For more information aboutdefining and compiling a pipeline, seeBuild a pipeline.

  2. Use the following code sample to convert the compiled pipeline YAML fileto an in-memory pipeline spec.

    importyamlwithopen("COMPILED_PIPELINE_PATH","r")asstream:try:pipeline_spec=yaml.safe_load(stream)print(pipeline_spec)exceptyaml.YAMLErrorasexc:print(exc)

    ReplaceCOMPILED_PIPELINE_PATH with the local path to your compiled pipelineYAML file.

Create the pipeline run

Use the following samples to create a pipeline run usingPrivate Service Connect interfaces:

Python

To create a pipeline run withPrivate Service Connect interfaces usingthe Vertex AI SDK for Python, configure the run using theaiplatform_v1/services/pipeline_service definition.

# Import aiplatform and the appropriate API version v1fromgoogle.cloudimportaiplatform,aiplatform_v1# Initialize the Vertex SDK using PROJECT_ID and LOCATIONaiplatform.init(project="PROJECT_ID",location="LOCATION")# Create the API endpointclient_options={"api_endpoint":f"LOCATION-aiplatform.googleapis.com"}# Initialize the PipelineServiceClientclient=aiplatform_v1.PipelineServiceClient(client_options=client_options)PSCI_INTERFACE_CONFIG={"network_attachment":"NETWORK_ATTACHMENT_NAME","dns_peering_configs":[{"domain":"DNS_DOMAIN","target_project":"TARGET_PROJECT","target_network":"TARGET_NETWORK"}]}# Construct the requestrequest=aiplatform_v1.CreatePipelineJobRequest(parent=f"projects/PROJECT_ID/locations/LOCATION",pipeline_job=aiplatform_v1.PipelineJob(display_name="DISPLAY_NAME",pipeline_spec=PIPELINE_SPEC,runtime_config=aiplatform_v1.PipelineJob.RuntimeConfig(gcs_output_directory="OUTPUT_DIRECTORY",),psc_interface_config=aiplatform_v1.PscInterfaceConfig(PSCI_INTERFACE_CONFIG),)# Make the API callresponse=client.create_pipeline_job(request=request)# Print the responseprint(response)

Replace the following:

  • PROJECT_ID: The project ID of the project where you want to create the pipeline run.
  • LOCATION: The region where you want to create the pipeline run.
  • DISPLAY_NAME: The name of the pipeline job. The maximum length for a display name is 128 UTF-8 characters.
  • PIPELINE_SPEC: The pipeline spec you created inCreate a pipeline spec.
  • OUTPUT_DIRECTORY: The URI of the Cloud Storage bucket for storing output artifacts. This path is the root output directory for the pipeline and is used to generate the paths of output artifacts.
  • NETWORK_ATTACHMENT_NAME: The name of the Compute Engine network attachment to attach to thePipelineJob resource. To obtain the network attachment, you must have completed the steps in theBefore you begin section. For more information about the network attachment, seeSet up a VPC network, subnet, and network attachment.
  • DNS_DOMAIN: The DNS name of the private cloud DNS zone you created when you set up private DNS peering.
  • TARGET_PROJECT: The project hosting the VPC network.
  • TARGET_NETWORK: The VPC network name.

REST

To create a pipeline run, send aPOST request by using thepipelineJobs.createmethod.

Before using any of the request data, make the following replacements:

  • PROJECT_ID: The project ID of the project where you want to create the pipeline run.
  • LOCATION: The region where you want to create the pipeline run.
  • DISPLAY_NAME: The name of the pipeline job. The maximum length for a display name is 128 UTF-8 characters.
  • PIPELINE_SPEC: The pipeline spec you created inCreate a pipeline spec.
  • OUTPUT_DIRECTORY: The URI of the Cloud Storage bucket for storing output artifacts. This path is the root output directory for the pipeline and is used to generate the paths of output artifacts.
  • NETWORK_ATTACHMENT_NAME: The name of the Compute Engine network attachment to attach to thePipelineJob resource. To obtain the network attachment, you must have completed the steps in theBefore you begin section. For more information about the network attachment, seeSet up a VPC network, subnet, and network attachment.
  • DNS_DOMAIN: The DNS name of the private cloud DNS zone you created when you set up private DNS peering.
  • TARGET_PROJECT: The project hosting the VPC network.
  • TARGET_NETWORK: The VPC network name.

HTTP method and URL:

POST https://LOCATION-aiplatform.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/pipelineJobs

Request JSON body:

{  "display_name": "DISPLAY_NAME",  "pipeline_spec": "PIPELINE_SPEC",  "runtime_config": {       "gcs_output_directory": "OUTPUT_DIRECTORY",   },   "psc_interface_config": {      "network_attachment": "NETWORK_ATTACHMENT_NAME",      "dns_peering_configs": [      {        "domain": "DNS_DOMAIN",        "target_project": "TARGET_PROJECT",        "target_network": "TARGET_NETWORK"      }    ]  }}

To send your request, choose one of these options:

curl

Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login , or by usingCloud Shell, which automatically logs you into thegcloud CLI . You can check the currently active account by runninggcloud auth list.

Save the request body in a file namedrequest.json, and execute the following command:

curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://LOCATION-aiplatform.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/pipelineJobs"

PowerShell

Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login . You can check the currently active account by runninggcloud auth list.

Save the request body in a file namedrequest.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
-Method POST `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://LOCATION-aiplatform.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/pipelineJobs" | Select-Object -Expand Content

You should see output similar to the following.PIPELINE_JOB_ID represents the ID of the pipeline run andSERVICE_ACCOUNT_NAME represents the service account used to run the pipeline.

{  "name": "projects/PROJECT_ID/locations/LOCATION/pipelineJobs/PIPELINE_JOB_ID",  "displayName": "DISPLAY_NAME",  "createTime": "20xx-01-01T00:00:00.000000Z",  "updateTime": "20xx-01-01T00:00:00.000000Z",  "pipelineSpec":PIPELINE_SPEC,  "state": "PIPELINE_STATE_PENDING",  "labels": {    "vertex-ai-pipelines-run-billing-id": "VERTEX_AI_PIPELINES_RUN_BILLING_ID"  },  "runtimeConfig": {    "gcsOutputDirectory": "OUTPUT_DIRECTORY"  },  "serviceAccount": "SERVICE_ACCOUNT_NAME"  "pscInterfaceConfig": {    "networkAttachment": "NETWORK_ATTACHMENT_NAME",    "dnsPeeringConfigs": [      {        "domain": "DNS_DOMAIN",        "targetProject": "TARGET_PROJECT",        "targetNetwork": "TARGET_NETWORK"      }    ]  }}

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-18 UTC.