0

Official documentation for Pub/Sub service states that Push is available to listeners that are available on public network:

An HTTPS server with non-self-signed certificate accessible on the public web.

That sounds pretty clear - but I wonder if I haven't miss something. Is it in any way possible to have Pub/Sub service push messages to on-premise machines, that are not on public internet?

Ivan
  • 867
  • 1
  • 8
  • 15

4 Answers4

0

You should be able to achieve this with cloud Nat

  • Reserve a static IP
  • Link your DNS with this IP
  • Create a subnet
  • Create a route from this subnet to your VPN
  • Create a Nat with your external IP and which forward request to your subnet
  • Deploy an OnPrem webserver (apache, nginx) with valid certificate for your DNS
  • Update your OnPrem route for reaching your webserver and don't forget to route the flow back!
guillaume blaquiere
  • 66,369
  • 2
  • 47
  • 76
0

Is it in any way possible to have Pub/Sub service push messages to on-premise machines, that are not on public internet?

Not easily, if at all. You might be able to use a Reverse Proxy. This introduces several layers to manage: proxy configuration, proxy compute instance, SSL Certificates, VPC routing, on-prem router, etc. See guillaume blaquiere's answer.

On-prem resource can reach Pub/Sub via public Internet or via VPN to private.googleapis.com but Pub/Sub cannot connect to on-prem or VPC resources configured with private IP addresses.

John Hanley
  • 74,467
  • 6
  • 95
  • 159
0

Cloud Pub/Sub push subscriptions require a publicly accessible HTTPS endpoint. If you want to reach on-premise machines, that would have to be done via a proxy/router accessible via the public internet (as others have mentioned). Cloud Pub/Sub does not currently support VPC for push subscriptions.

Please see the note section under https://cloud.google.com/pubsub/docs/push

Qiqi Wu
  • 421
  • 2
  • 7
-1

Previous answers are outdated. You can use restricted Virtual IP with Private Google Access to provide a private network route for requests to Google Cloud services without exposing the requests to the internet.

Sébastien Lorion
  • 88
  • 6