feat: Implement private services connection module with examples and tests (#692)

Co-authored-by: krprabhat-eng <krprabhat@google.com>

Author: zubitripathy

README.md

@@ -125,6 +125,7 @@ Then perform the following commands on the root folder:
 | network\_firewall\_policy\_enforcement\_order | Set the order that Firewall Rules and Firewall Policies are evaluated. Valid values are `BEFORE_CLASSIC_FIREWALL` and `AFTER_CLASSIC_FIREWALL`. (default null or equivalent to `AFTER_CLASSIC_FIREWALL`) | `string` | `null` | no |
 | network\_name | The name of the network being created | `string` | n/a | yes |
 | network\_profile | "A full or partial URL of the network profile to apply to this network.<br>This field can be set only at resource creation time. For example, the<br>following are valid URLs:<br>  * https://www.googleapis.com/compute/beta/projects/{projectId}/global/networkProfiles/{network_profile_name}<br>  * projects/{projectId}/global/networkProfiles/{network\_profile\_name} | `string` | `null` | no |
+| private\_service\_access\_config | Configuration for Private Service Access (PSA) connection. | <pre>object({<br>    enable_private_services_connection = bool<br>    address_name                       = string<br>    prefix_length                      = number<br>  })</pre> | <pre>{<br>  "address_name": "private-ip-address",<br>  "enable_private_services_connection": false,<br>  "prefix_length": 16<br>}</pre> | no |
 | project\_id | The ID of the project where this VPC will be created | `string` | n/a | yes |
 | routes | List of routes being created in this VPC. | <pre>list(object({<br>    name                   = string<br>    description            = optional(string)<br>    tags                   = optional(list(string), [])<br>    destination_range      = string<br>    next_hop_gateway       = optional(string)<br>    next_hop_internet      = optional(bool, false)<br>    next_hop_ip            = optional(string)<br>    next_hop_instance      = optional(string)<br>    next_hop_instance_zone = optional(string)<br>    next_hop_vpn_tunnel    = optional(string)<br>    next_hop_ilb           = optional(string)<br>    priority               = optional(number, 1000)<br>  }))</pre> | `[]` | no |
 | routing\_mode | The network routing mode (default 'GLOBAL') | `string` | `"GLOBAL"` | no |

examples/network_connectivity_center/main.tf

@@ -107,7 +107,9 @@ module "network_connectivity_center_star" {
 #          VPC Spoke           #
 ################################
 module "vpc_spoke_vpc" {
-  source       = "terraform-google-modules/network/google"
+  source  = "terraform-google-modules/network/google"
+  version = "~> 18.0"
+
   project_id   = var.project_id
   network_name = var.vpc_spoke_vpc_name
   routing_mode = "GLOBAL"
@@ -137,6 +139,7 @@ module "vpc_spoke_vpc" {
 # Simulates an on-prem network that will be connected over VPN
 module "vpn_spoke_remote_vpc" {
   source       = "terraform-google-modules/network/google"
+  version      = "~> 18.0.0"
   project_id   = var.project_id
   network_name = var.vpn_spoke_remote_vpc_name
   routing_mode = "GLOBAL"
@@ -162,6 +165,7 @@ module "vpn_spoke_remote_vpc" {
 
 module "vpn_spoke_local_vpc" {
   source       = "terraform-google-modules/network/google"
+  version      = "~> 18.0.0"
   project_id   = var.project_id
   network_name = var.vpn_spoke_local_vpc_name
   routing_mode = "GLOBAL"
@@ -260,6 +264,7 @@ resource "random_shuffle" "zone" {
 
 module "router_appliance_spoke_vpc" {
   source       = "terraform-google-modules/network/google"
+  version      = "~> 18.0.0"
   project_id   = var.project_id
   network_name = var.router_appliance_vpc_name
   routing_mode = "GLOBAL"

examples/private-service-access/main.tf

@@ -0,0 +1,35 @@
+/**
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module "vpc" {
+  source       = "../.."
+  project_id   = var.project_id
+  network_name = "example-psa-vpc"
+
+  private_service_access_config = {
+    enable_private_services_connection = true
+    address_name                       = "custom-psa-address"
+    prefix_length                      = 16
+  }
+
+  subnets = [
+    {
+      subnet_name   = "psa-subnet"
+      subnet_ip     = "10.0.0.0/24"
+      subnet_region = "us-central1"
+    }
+  ]
+}

examples/private-service-access/variables.tf

@@ -0,0 +1,20 @@
+/**
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "project_id" {
+  description = "The ID of the project where the network will be created."
+  type        = string
+}

examples/private-service-access/versions.tf

@@ -0,0 +1,34 @@
+/**
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+terraform {
+  required_version = ">= 1.3"
+
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = ">= 6.18, < 8"
+    }
+    google-beta = {
+      source  = "hashicorp/google-beta"
+      version = ">= 6.18, < 8"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.4"
+    }
+  }
+}

examples/routes/main.tf

@@ -23,7 +23,7 @@
 # [START vpc_static_route_create]
 module "google_compute_route" {
   source       = "../../modules/routes" #adding local path
-  project_id   = var.project_id # Replace this with your project ID in quotes
+  project_id   = var.project_id         # Replace this with your project ID in quotes
   network_name = "default"
 
   routes = [

main.tf

@@ -90,3 +90,13 @@ module "firewall_rules" {
   ingress_rules = var.ingress_rules
   egress_rules  = var.egress_rules
 }
+
+module "private_service_access" {
+  source = "./modules/private-service-access"
+  count  = var.private_service_access_config.enable_private_services_connection ? 1 : 0
+
+  project_id    = var.project_id
+  network_id    = module.vpc.network_id
+  address_name  = var.private_service_access_config.address_name
+  prefix_length = var.private_service_access_config.prefix_length
+}

metadata.display.yaml

@@ -94,6 +94,9 @@ spec:
           title: Network Profile
           regexValidation: ^(?:https://www\\.googleapis\\.com/compute/[a-zA-Z0-9._-]+/)?projects/(?:(?:[a-z0-9.-]+:)?[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)/global/networkProfiles/[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?$
           validation: "The full or partial URL of the network profile. Examples: 'https://www.googleapis.com/compute/v1/projects/my-project/global/networkProfiles/my-profile' or 'projects/my-project/global/networkProfiles/my-profile'."
+        private_service_access_config:
+          name: private_service_access_config
+          title: Private Service Access Config
         project_id:
           name: project_id
           title: Project Id

metadata.yaml

@@ -45,6 +45,8 @@ spec:
         location: modules/network-firewall-policy
       - name: network-peering
         location: modules/network-peering
+      - name: private-service-access
+        location: modules/private-service-access
       - name: private-service-connect
         location: modules/private-service-connect
       - name: private-service-connect-endpoints-for-published-services
@@ -96,6 +98,8 @@ spec:
         location: examples/network_service_tiers
       - name: packet_mirroring
         location: examples/packet_mirroring
+      - name: private-service-access
+        location: examples/private-service-access
       - name: private_service_connect
         location: examples/private_service_connect
       - name: private_service_connect_endpoints_for_published_services
@@ -322,6 +326,18 @@ spec:
       - name: bgp_inter_region_cost
         description: Specifies the BGP inter-region cost mode. Valid values are `DEFAULT` or `ADD_COST_TO_MED`.
         varType: string
+      - name: private_service_access_config
+        description: Configuration for Private Service Access (PSA) connection.
+        varType: |-
+          object({
+              enable_private_services_connection = bool
+              address_name                       = string
+              prefix_length                      = number
+            })
+        defaultValue:
+          address_name: private-ip-address
+          enable_private_services_connection: false
+          prefix_length: 16
     outputs:
       - name: network
         description: The created network

modules/fabric-net-firewall/metadata.yaml

@@ -64,6 +64,8 @@ spec:
         location: examples/network_service_tiers
       - name: packet_mirroring
         location: examples/packet_mirroring
+      - name: private-service-access
+        location: examples/private-service-access
       - name: private_service_connect
         location: examples/private_service_connect
       - name: private_service_connect_endpoints_for_published_services