Skip to main content

TSB-2025-22 Existing Private Service Connect enabled clusters require additional ports opened

  • Updated

Technical Service Bulletin (2025-22)

Subject: 

To allow Redpanda to fully manage your Private Service Connect enabled clusters on GCP we now require additional port ranges to be always open on the PSC Consumer network side. This is required due to the port based nature of Private Service Connect.

Summary: 

To allow Redpanda to fully and completely manage your Private Service Connect enabled cluster on GCP you will need to review and potentially make the following changes in the firewall rules listed in the documentation link and procedure below.  

Severity: 

Med

Redpanda Products Affected:

Private Service Connect enabled clusters on GCP running with

  • Dedicated
  • BYOC
  • BYOVPC

Release Affected:

All Releases

Identification:

Any Redpanda Cluster on GCP that uses the Private Service Connect connectivity feature. You can check each cluster by going to the Cluster Settings Page in Cloud UI, which is only visible on private network clusters, to see if it is enabled.

Impact: 

If these additional port ranges are not open on the PSC consumer network side to your clients, they will be unable to connect to your Redpanda cluster after upcoming cluster maintenance events; Tier Migration, Scaling, Kubernetes upgrades, VM refreshes. Due to rotating new brokers into the next available broker port range.

You may not have port restrictions on the network access to the Private Service Connect Endpoint network, in which case you can either add the explicit range as detailed below, or leave it as is (open).

If you have firewall port restrictions on the network access to the Private Service Connect Endpoint network then they must be updated to include the new ranges as detailed below.

Action required: 

Please ensure you are not using broker ports for any client seeding/bootstrapping. For correct bootstrapping you must use the fixed bootstrap/seed port on 30292 for Private Service Connect.  Please complete this work by April 11th, 2025.

Performing the actions in this TSB will not cause an outage or downtime.

Find your existing Private Service Connect Endpoint network firewall

Find the forwarding rules by service attachment. The service attachment must match the service attachment in your cluster settings page:

gcloud compute forwarding-rules list \

--filter 'target~serviceAttachments'

NAME           REGION    IP_ADDRESS  IP_PROTOCOL  TARGET

slord-pscendpoint  europe-west1  10.0.0.2             europe-west1/serviceAttachments/rp-cvdad6d1uuil2f9uv1u0-psc2

Take note of the IP_ADDRESS, you will need this later.

Describe the forwarding rule in order to find the network it is attached to:

gcloud compute forwarding-rules describe slord-pscendpoint

IPAddress: 10.0.0.2

allowPscGlobalAccess: true

creationTimestamp: '2025-03-19T06:30:34.266-07:00'

fingerprint: lGLBwIXrLao=

id: '5395454026197727253'

kind: compute#forwardingRule

labelFingerprint: 42WmSpB8rSM=

name: slord-pscendpoint

network: https://www.googleapis.com/compute/v1/projects/rp-byoc-slord-366019/global/networks/slord-psc-net

networkTier: PREMIUM

pscConnectionId: '46530391657414658'

pscConnectionStatus: ACCEPTED

region: https://www.googleapis.com/compute/v1/projects/rp-byoc-slord-366019/regions/europe-west1

selfLink: https://www.googleapis.com/compute/v1/projects/rp-byoc-slord-366019/regions/europe-west1/forwardingRules/slord-pscendpoint

serviceDirectoryRegistrations:

- namespace: goog-psc-default

target: https://www.googleapis.com/compute/v1/projects/rp-cvdab5d1uuil2f9uv1pg/regions/europe-west1/serviceAttachments/rp-cvdad6d1uuil2f9uv1u0-psc2

Take note of the network name, you will need this later.

Updating Redpanda Port Ranges On PSC Consumer Network subnet

This command will open all required ports for VMs on your VPC to access Redpanda via the Private Service Connect endpoint within the same VPC. If you already have a firewall rule in place then you can update it in place with the updated port allow list.

gcloud compute firewall-rules create redpanda-psc \

  --description="Allow access to Redpanda PSC endpoint" \

  --network="<your network name>" \

  --project="<your GCP project id>" \

  --direction="EGRESS" \

  --destination-ranges="<your Redpanda PSC endpoint IP address as found in the forwarding rule>" \

 --allow="tcp:443,tcp:30081,tcp:30282,tcp:30292,tcp:32092-32141,tcp:35082-35131,tcp:32192-32241,tcp:35182-35231,tcp:32292-32341,tcp:35282-35331"

Please note the above opens 6 medium sized port ranges designed to allow for clusters up to 50 brokers in size. You may wish to tighten these but beware if you move your cluster to a different tier these ranges will also need opening up (so it would be best to leave them as is above).

Please note the range ports are for access to the Redpanda brokers (Kafka API, Panda proxy) and are not all used simultaneously. They must remain open on the firewall to provide a fully managed service. The broker instances move between the ranges for certain maintenance operations that require broker VMs to move to newer base images and/or instance types (notably kubernetes upgrades and tier migration at present). Therefore it is also important to ensure all clients are using the seed port and not relying on fixed broker specific ports.

More information on securing Private Service Connect endpoints can be found here: 

https://cloud.google.com/vpc/docs/manage-security-private-service-connect-consumers#firewall-rules

Questions? If you have any questions on this TSB, or need further guidance, please reach out to Redpanda Support.