Deploy private web apps

Create a Private Service Connect (PSC) URL to connect the private apps in your environment.

To set up the PSC URL, create an internal load balancer, and then create a service attachment that uses an internal IP address. 

Create an internal load balancer

You should publish private apps in private apps in Google Workspace behind an internal load balancer with global access enabled. For details, see Publish a service with automatic approval.

Create an internal passthrough Network Load Balancer for Compute or GKE resource

Before you begin: To allow secure HTTPS communication, set up an instance group configured to serve requests on port 443. Select the instance group in the Backend configuration tab.

1. In the Google Cloud console, go to the Load balancing page.
2. Click Create Load Balancer.
3. Click Start Configuration for Network Load Balancer (TCP/SSL) and select the following:
   1. For Type of load balancer—Network Load Balancer (TCP/UDP/SSL).
   2. For Proxy or passthrough—Passthrough.
   3. For Internet facing or internal only—Internal.
   4. Click Next.
   5. Click Continue.
4. Enter the load balancer name, and select the region and network where you will deploy the load balancer.
   Important: The network you choose for the load balancer must be the same network used by your instance group.
5. Click the Backend configuration tab.
   1. For Protocol—Select TCP. 
   2. For IP stack type—Select IPv4. 
   3. Select an instance group.
      To create one, go to Instance groups.
   4. Select a health check from the list.  To create a new health check:
      1. Select Create health check.
      2. Enter a name for your health check (for example: ping-port).
      3. Select regional scope.
      4. For the protocol, select HTTPS.
      5. Keep the port as 443.
      6. For Proxy protocol, select NONE.
      7. For Request path, leave "/".
      8. Enable logs.
      9. Keep the default values for the health criteria.
6. Click the Frontend configuration tab
   1. (Optional) Enter a name for the frontend.
   2. For IP version, select IPv4.
   3. Select a subnetwork.
   4. For internal IP purpose, select Non-shared.
   5. For ports, select Single.
   6. Enter port number 443.
   7. For Global access, select Enable.
7. Click the Review and finalize tab to review your load balancer configuration settings.
8. Click Create.

Create an internal Load Balancer for a Cloud Run resource

1. In the Google Cloud console, go to the Load balancing page.
2. Click Create Load Balancer.
3. Click Start Configuration for application load balancer (HTTP/S) and select the following.
   1. For Type of load balancer—Select Application Load Balancer (HTTP/HTTPS).
   2. For Internet facing or internal only—Select internal.
   3. For Cross-region or single region deployment—Select single region.
   4. Click Next.
   5. Click Configure.
4. Enter the load balancer name and select the region and network where the load balancer will be deployed.
5. Click the Backend configuration tab.
   1. Create or select the backend service.
   2. If creating a service, for Backend type, select Serverless Network Endpoint Group and select a network endpoint group.
   3. If you don’t have a serverless network endpoint, select the option to create a new one.
      Before creating the serverless network endpoint group, create a Cloud Run service that the endpoint group will point to.
6. Click the Frontend configuration tab
   1. For Protocol—Select HTTPS.
   2. Select the subnetwork.
   3. If you haven't reserved a subnet yet, complete the onscreen steps.
   4. Enable global access.
   5. For the certificate, select to create a new one or choose an existing certificate.
7. Click Create.

Create the service attachment URL

To set up the PSC URL, create a service attachment that uses an internal IP address.

1. In the Google Cloud console, go to the Private Service Connect page.
2. Click the Publish service tab.
3. Click Publish service.
4. Select the Load balancer type for the service that you want to publish:
   • Internal passthrough Network Load Balancer
   • Regional internal proxy Network Load Balancer
   • Regional internal Application Load Balancer
5. Select the Internal load balancer that hosts the service that you want to publish.
   The network and region fields are populated with the details for the selected internal load balancer.
6. For Service name, enter a name for the service attachment.
7. Select one or more Subnets for the service. If you want to add a new subnet, you can create one:
   1. Click Reserve new subnet.
   2. Enter a Name and optional Description for the subnet.
   3. Select a Region for the subnet.
   4. Enter the IP range to use for the subnet and click Add.
8. For Connection preference, select Automatically accept all connections.
9. Click Add service.
10. Click the published service. Use the service attachment name in the Service attachment field to create the URL:
    https://googleapis.com/compute/v1/SERVICE_ATTACHMENT_NAME

When you add your private web app in Google Workspace, use this URL. See Add the app to your Workspace account.