// Module included in the following assemblies:
//
// * osd_gcp_clusters/creating-a-gcp-psc-enabled-private-cluster.adoc

:_mod-docs-content-type: CONCEPT
[id="private-service-connect-prereqs"]
= Prerequisites

[role="_abstract"]
In addition to the prerequisites that you need to complete before deploying any {product-title} on {GCP} cluster, you must also complete the following prerequisites to deploy a private cluster using Private Service Connect (PSC):

* A pre-created Virtual Private Cloud (VPC) with the following subnets in the same {GCP} region where your cluster will be deployed:

** A control plane subnet
** A worker subnet
** A subnet used for the PSC service attachment with the purpose set to Private Service Connect
+
[IMPORTANT]
====
The subnet mask for the PSC service attachment must be /29 or larger and must be dedicated to an individual {product-title} cluster. Additionally, the subnet must be contained within the Machine CIDR range used while provisioning the {product-title} cluster.
====
+
For information about how to create a VPC on {GCP}, see link:https://cloud.google.com/vpc/docs/create-modify-vpc-networks[Create and manage VPC networks] in the {gcp-full} documentation.

* Provide a path from the OpenShift Dedicated cluster to the internet for the domains and ports listed in the _{gcp-short} firewall prerequisites_ in the _Additional resources_ section.

* Enabled link:https://console.cloud.google.com/marketplace/product/google/iap.googleapis.com?q=search&referrer=search&hl=en&project=openshift-gce-devel[Cloud Identity-Aware Proxy API] at the {GCP} project level.

In addition to the requirements listed above, clusters configured with the **Service Account authentication type** must grant the `IAP-Secured Tunnel User` role to `osd-ccs-admin` service account.

For more information about the prerequisites that must be completed before deploying an {product-title} on {GCP}, see _Customer Requirements_.

[NOTE]
====
PSC is supported with the Customer Cloud Subscription (CCS) infrastructure type only. To create an {product-title} on {GCP} using PSC, see _Creating a cluster on {gcp-short} with Workload Identity Federation_.
====



