> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt

# Manage Private Endpoints for Dedicated Clusters

Atlas Kubernetes Operator doesn't support Atlas Infinite Database clusters in public preview. To learn which features Atlas Infinite Database supports in public preview, see [Atlas Infinite Database Edition](https://www.mongodb.com/docs/atlas/infinite/atlas-infinite-landing/). To learn more about preview features, see [Preview Features](https://www.mongodb.com/docs/preview-features/).

**Note:**

This feature is not available for any of the following deployments:

- `M0` clusters

- `M2/M5` clusters

- Flex clusters

Atlas Kubernetes Operator supports managing private endpoints for dedicated clusters on the following platforms:

- AWS (Amazon Web Services) using the [AWS PrivateLink](https://aws.amazon.com/privatelink/) feature.

- Azure (Microsoft Azure) using the [Azure Private Link](https://azure.microsoft.com/en-us/services/private-link/) feature.

- Google Cloud using the [Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect) feature.

## Prerequisites

To enable connections with Atlas Kubernetes Operator to Atlas using private endpoints, you must:

- Have a running Kubernetes cluster with Atlas Kubernetes Operator [deployed.](https://www.mongodb.com/docs/atlas/operator/current/ak8so-quick-start.md#std-label-ak8so-quick-start-ref)

* Have either the [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner) or [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) role in Atlas.

* Have an AWS (Amazon Web Services) user account with an IAM (Identity and Access Management) user policy that grants permissions to create, modify, describe, and delete endpoints. For more information on controlling the use of interface endpoints, see the [AWS Documentation.](http://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html)

* **(Recommended)**: [Install the AWS CLI.](http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html)

* If you have not already done so, create your VPC (Virtual Private Cloud) and EC2 instances in AWS (Amazon Web Services). See the [AWS documentation](http://docs.aws.amazon.com/index.html) for guidance.

- Have a running Kubernetes cluster with Atlas Kubernetes Operator [deployed.](https://www.mongodb.com/docs/atlas/operator/current/ak8so-quick-start.md#std-label-ak8so-quick-start-ref)

* Have either the [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner) or [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) role in Atlas.

* Install the [Azure CLI.](https://docs.microsoft.com/en-us/azurehttps://docs.microsoft.com/en-us/cli/azure/install-azure-cli)

* If you have not already done so, create your VNet and Compute instances in Azure (Microsoft Azure). See the [Azure documentation](https://docs.microsoft.com/en-us/azure/) for guidance.

- Have a running Kubernetes cluster with Atlas Kubernetes Operator [deployed.](https://www.mongodb.com/docs/atlas/operator/current/ak8so-quick-start.md#std-label-ak8so-quick-start-ref)

- Have the [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner) or [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) role in Atlas.

- Have a Google Cloud user account with an IAM (Identity and Access Management) user policy and a [Compute Network Admin](https://cloud.google.com/iam/docs/understanding-roles#compute.networkAdmin) role that grants permissions to create, modify, and delete networking resources. To learn more about managing private endpoints and connections, see the [Google Cloud documentation.](https://cloud.google.com/vpc/docs/overview.html)

- Install [the gcloud CLI.](https://cloud.google.com/sdk/docs/install)

- If you have not already done so, create your VPC (Virtual Private Cloud) and Compute instances in Google Cloud. To learn more, see the [GCP documentation.](https://cloud.google.com/vpc/docs/using-vpc.html)

- Ensure egress firewall rules permit traffic to the internal IP address of the Private Service Connect endpoint.

- (Optional) If you enforce a security perimeter with VPC (Virtual Private Cloud) service controls (VPC-SC), you must create ingress and egress rules to establish the connection between the Private Service Connect endpoint and Atlas clusters. To learn more, see the [GCP documentation.](https://cloud.google.com/vpc/docs/configure-private-service-connect-services#vpc-sc)

## Procedure

To enable clients to connect to Atlas dedicated clusters using private endpoints:

1. Specify the `spec.privateEndpoints` parameter.

   Specify the [spec.privateEndpoints](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-spec-privateendpoints) parameter for the [`AtlasProject` Custom Resource](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource). In the `spec.privateEndpoints.provider` field, specify `AWS`. Replace the placeholder `{aws-region}` with the [AWS region](https://www.mongodb.com/docs/atlas/reference/amazon-aws.md#std-label-amazon-aws) information for your private endpoints and run the following command:

   ```sh
   cat <<EOF | kubectl apply -f -
   apiVersion: atlas.mongodb.com/v1
   kind: AtlasProject
   metadata:
     name: my-project
   spec:
     name: Test Atlas Operator Project
     privateEndpoints:
     - provider: "AWS"
       region: "{aws-region}"
   EOF
   ```

   Atlas creates the VPC (Virtual Private Cloud) resources in the region you selected. This might take several minutes to complete.

2. Find the service names for your private endpoints.

   Run the following command:

   ```sh
   kubectl get atlasproject my-project -o yaml
   ```

   Note the service name string for each private endpoint within the `status.privateEndpoints.serviceName` field of the [`AtlasProject` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource)

3. Use the AWS CLI to configure each private endpoint.

   To create your application VPC (Virtual Private Cloud) [interface endpoint:](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-interface-endpoint)

   Copy the following command:

   ```sh
   aws ec2 create-vpc-endpoint --vpc-id {your-application-vpc-id} --region {aws-region} --service-name {service-name-string} --vpc-endpoint-type Interface --subnet-ids {your-application-subnet-ids}
   ```

   Replace the following placeholders with the details about your AWS (Amazon Web Services) VPC (Virtual Private Cloud):

   | `your-application-vpc-id` | Unique string that identifies the peer AWS (Amazon Web Services) VPC (Virtual Private Cloud). Find this value on the VPC (Virtual Private Cloud) dashboard in your AWS (Amazon Web Services) account. |
   | --- | --- |
   | `aws-region` | Label that identifies the [AWS region](https://www.mongodb.com/docs/atlas/reference/amazon-aws.md#std-label-amazon-aws) of the private endpoint. |
   | `service-name-string` | Unique string that identifies the service name for your private endpoint. Find this value within the `status.privateEndpoints.serviceName` field of the [`AtlasProject` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource) |
   | `your-application-subnet-ids` | Unique strings that identify the subnets your AWS (Amazon Web Services) VPC (Virtual Private Cloud) uses. Separate each subnet with a space. Find these values on the Subnet  dashboard in your AWS (Amazon Web Services) account. IMPORTANT: You must specify at least one subnet. If you don't, AWS (Amazon Web Services) won't provision a [interface endpoint](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-interface-endpoint) in your VPC (Virtual Private Cloud). An interface endpoint is required for clients in your VPC (Virtual Private Cloud) to send traffic to the private endpoint. |

   Run the command with the [AWS CLI.](http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html)

   Note the `VpcEndpointId` value in the output.

   **Example**

   ```sh
   "VpcEndpoint": {
            "VpcEndpointId": "vpce-XXXXXX",
            "VpcEndpointType": "Interface",
            "VpcId": "vpc-XXXXX",
            "ServiceName": "com.amazonaws.vpce.{aws-region}.vpce-svc-XXXX",
            "State": "pendingAcceptance",
   ```

   To learn more, see [Creating an Interface Endpoint](http://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint) in the AWS (Amazon Web Services) documentation.

4. Update the `spec.privateEndpoints` parameter.

   Update the [spec.privateEndpoints](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-spec-privateendpoints) parameter for the [`AtlasProject` Custom Resource](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource). Specify the [AWS region](https://www.mongodb.com/docs/atlas/reference/amazon-aws.md#std-label-amazon-aws) and replace `vpce-id` with the `VpcEndpointId` values for your private endpoints and run the following command:

   **Note:**

   You can find the unique identifier of the peer AWS (Amazon Web Services) VPC (Virtual Private Cloud) on the VPC (Virtual Private Cloud) dashboard in your AWS (Amazon Web Services) account.

   ```sh
   cat <<EOF | kubectl apply -f -
   apiVersion: atlas.mongodb.com/v1
   kind: AtlasProject
   metadata:
     name: my-project
   spec:
     name: Test Atlas Operator Project
     privateEndpoints:
     - provider: "AWS"
       region: "{aws-region}"
       id: "{vpce-id}"
   EOF
   ```

5. Check the status of your private endpoints using Atlas Kubernetes Operator.

   Run the following command:

   ```sh
   kubectl get atlasproject my-project -o yaml
   ```

6. Retrieve the secret that Atlas Kubernetes Operator created to connect to the cluster.

   Copy the following command:

   **Important:**

   The following command requires `jq` 1.6 or higher.

   ```sh
   kubectl get secret {my-project}-{my-atlas-cluster}-{my-database-user} -o json | jq -r '.data | with_entries(.value |= @base64d)';
   ```

   Replace the following placeholders with the details for your custom resources:

   | `my-project` | Specify the value of the `metadata` field of your [`AtlasProject` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource) |
   | --- | --- |
   | `my-atlas-cluster` | Specify the value of the `metadata` field of your [`AtlasDeployment` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasdeployment-custom-resource.md#std-label-atlasdeployment-custom-resource) |
   | `my-database-user` | Specify the value of the `metadata` field of your [`AtlasDatabaseUser` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasdatabaseuser-custom-resource.md#std-label-atlasdatabaseuser-custom-resource) |

   Run the command.

   **Note:**

   Your connection strings will differ from the following example. If you have multiple private endpoints, the secret contains multiple `connectionStringPrivate` and `connectionStringPrivateSvr` fields with the appropriate numeric suffix (for example, `connectionStringPrivate1`, `connectionStringPrivate2`, and so on).

   ```sh
   {
     "connectionStringPrivate": "mongodb://pl-0-eastus2.uzgh6.mongodb.net:1024,pl-0-eastus2.uzgh6.mongodb.net:1025,pl-0-eastus2.uzgh6.mongodb.net:1026/?ssl=truereplicaSet=atlas-18bndf-shard-0",
     "connectionStringPrivateSrv": "mongodb+srv://cluster0-pl-0.uzgh6.mongodb.net",
     "password": "P@@sword%",
     "username": "theuser"
    }
   ```

   You can use this [secret](https://kubernetes.io/docs/concepts/configuration/secret/) in your application:

   ```sh
   containers:
     - name: test-app
       env:
       - name: "CONNECTION_STRING"
         valueFrom:
           secretKeyRef:
             name: my-project-my-atlas-cluster-my-database-user
             key: connectionStringPrivate
   ```

1) Specify the `spec.privateEndpoints` parameter.

   Specify the [spec.privateEndpoints](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-spec-privateendpoints) parameter for the [`AtlasProject` Custom Resource](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource). In the `spec.privateEndpoints.provider` field, specify `AZURE`. Replace the placeholder `{azure-region}` with the [Azure region](https://www.mongodb.com/docs/atlas/reference/microsoft-azure.md#std-label-microsoft-azure) information for your private endpoints and run the following command:

   ```sh
   cat <<EOF | kubectl apply -f -
   apiVersion: atlas.mongodb.com/v1
   kind: AtlasProject
   metadata:
     name: my-project
   spec:
     name: Test Atlas Operator Project
     privateEndpoints:
     - provider: "AZURE"
       region: "{azure-region}"
   EOF
   ```

   Atlas creates the VNET resources in the region you selected. This might take several minutes to complete.

2) Disable private endpoint network policies.

   Atlas doesn't support network policies for private endpoints.

   Copy the following command:

   ```sh
   az network vnet subnet update --resource-group {resource-group-name} --vnet-name {vnet-name} --name {subnet-name} --disable-private-endpoint-network-policies true
   ```

   Replace the following placeholders with the details about your Azure (Microsoft Azure) VNet:

   | `resource-group-name` | Human-readable label for the resource group that contains the VNet that you want to use to connect to Atlas. Find this value on the Resource Group Properties page on your Azure (Microsoft Azure) dashboard. |
   | --- | --- |
   | `vnet-name` | Human-readable label that identifies the VNet that you want to use to connect to Atlas. Find this value on the Virtual Network page on your Azure (Microsoft Azure) dashboard. |
   | `subnet-name` | Human-readable label that identifies the subnet in your Azure (Microsoft Azure) VNet. Find this value on the Virtual Network Subnets page on your Azure (Microsoft Azure) dashboard. |

   Run the command with the [Azure CLI.](https://docs.microsoft.com/en-us/azureinstall-azure-cli)

   To learn more, see the [Manage network policies for private endpoints](https://docs.microsoft.com/en-us/azure/private-link/disable-private-endpoint-network-policy) in the Azure (Microsoft Azure) documentation.

3) Find the service IDs and names for your private endpoints.

   Run the following command:

   ```sh
   kubectl get atlasproject my-project -o yaml
   ```

   Note the service resouce ID and service name for each private endpoint within the `status.privateEndpoints.serviceResourceId` and `status.privateEndpoints.serviceName` fields of the [`AtlasProject` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource)

4) Use the Azure CLI to configure each private endpoint.

   To create your private endpoint:

   Copy the following command:

   ```sh
   az network private-endpoint create --resource-group {resource-group-name} --name {endpoint-name} --vnet-name {vnet-name} --subnet {subnet-name} --private-connection-resource-id {serviceResourceId} --connection-name {serviceName} --manual-request true
   ```

   Replace the following placeholders with the details about your Azure (Microsoft Azure) VNet:

   | `resource-group-name` | Human-readable label for the resource group that contains the VNet that you want to use to connect to Atlas. Find this value on the Resource Group Properties page on your Azure (Microsoft Azure) dashboard. |
   | --- | --- |
   | `endpoint-name` | Human-readable label that identifies your private endpoint. Specify this now. |
   | `vnet-name` | Human-readable label that identifies the VNet that you want to use to connect to Atlas. Find this value on the Virtual Network page on your Azure (Microsoft Azure) dashboard. |
   | `subnet-name` | Human-readable label that identifies the subnet in your Azure (Microsoft Azure) VNet. Find this value on the Virtual Network Subnets page on your Azure (Microsoft Azure) dashboard. |
   | `serviceResourceId` | Unique string that identifies the service resource for your private endpoint. Find this value within the `status.privateEndpoints.serviceResourceId` field of the [`AtlasProject` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource) |
   | `serviceName` | Unique string that identifies the service name for your private endpoint. Find this value within the `status.privateEndpoints.serviceName` field of the [`AtlasProject` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource) |

   Run the command with the [Azure CLI.](https://docs.microsoft.com/en-us/azureinstall-azure-cli)

5) Update the `spec.privateEndpoints` parameter.

   Update the [spec.privateEndpoints](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-spec-privateendpoints) parameter for the [`AtlasProject` Custom Resource](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource). Specify the the [Azure region](https://www.mongodb.com/docs/atlas/reference/microsoft-azure.md#std-label-microsoft-azure), Resource ID, and IP address information for your private endpoints and run the following command:

   **Note:**

   The Properties page on your Azure (Microsoft Azure) dashboard displays the unique identifier for the private endpoint that you created in the Resource ID field.

   The Overview page on your Azure (Microsoft Azure) dashboard displays the private IP address of the private endpoint network interface that you created in the Private IP field.

   ```sh
   cat <<EOF | kubectl apply -f -
   apiVersion: atlas.mongodb.com/v1
   kind: AtlasProject
   metadata:
     name: my-project
   spec:
     name: Test Atlas Operator Project
     privateEndpoints:
     - provider: "Azure"
       region: "{azure-region}"
       id: "{resource-id}"
       ip: "{private-ip}"
   EOF
   ```

6) Check the status of your private endpoints using Atlas Kubernetes Operator.

   Run the following command:

   ```sh
   kubectl get atlasproject my-project -o yaml
   ```

7) Retrieve the secret that Atlas Kubernetes Operator created to connect to the cluster.

   Copy the following command:

   **Important:**

   The following command requires `jq` 1.6 or higher.

   ```sh
   kubectl get secret {my-project}-{my-atlas-cluster}-{my-database-user} -o json | jq -r '.data | with_entries(.value |= @base64d)';
   ```

   Replace the following placeholders with the details for your custom resources:

   | `my-project` | Specify the value of the `metadata` field of your [`AtlasProject` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource) |
   | --- | --- |
   | `my-atlas-cluster` | Specify the value of the `metadata` field of your [`AtlasDeployment` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasdeployment-custom-resource.md#std-label-atlasdeployment-custom-resource) |
   | `my-database-user` | Specify the value of the `metadata` field of your [`AtlasDatabaseUser` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasdatabaseuser-custom-resource.md#std-label-atlasdatabaseuser-custom-resource) |

   Run the command.

   **Note:**

   Your connection strings will differ from the following example. If you have multiple private endpoints, the secret contains multiple `connectionStringPrivate` and `connectionStringPrivateSvr` fields with the appropriate numeric suffix (for example, `connectionStringPrivate1`, `connectionStringPrivate2`, and so on).

   ```sh
   {
     "connectionStringPrivate": "mongodb://pl-0-eastus2.uzgh6.mongodb.net:1024,pl-0-eastus2.uzgh6.mongodb.net:1025,pl-0-eastus2.uzgh6.mongodb.net:1026/?ssl=truereplicaSet=atlas-18bndf-shard-0",
     "connectionStringPrivateSrv": "mongodb+srv://cluster0-pl-0.uzgh6.mongodb.net",
     "password": "P@@sword%",
     "username": "theuser"
    }
   ```

   You can use this [secret](https://kubernetes.io/docs/concepts/configuration/secret/) in your application:

   ```sh
   containers:
     - name: test-app
       env:
       - name: "CONNECTION_STRING"
         valueFrom:
           secretKeyRef:
             name: my-project-my-atlas-cluster-my-database-user
             key: connectionStringPrivate
   ```

1. Specify the `spec.privateEndpoints` parameter.

   Specify the [spec.privateEndpoints](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-spec-privateendpoints) parameter for the [`AtlasProject` Custom Resource](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource). In the `spec.privateEndpoints.provider` field, specify `GCP`. Replace the placeholder `{gcp-region}` with the [Google Cloud Platform region](https://www.mongodb.com/docs/atlas/reference/google-gcp.md#std-label-google-gcp) information for your private endpoints and run the following command:

   ```sh
   cat <<EOF | kubectl apply -f -
   apiVersion: atlas.mongodb.com/v1
   kind: AtlasProject
   metadata:
     name: my-project
   spec:
     name: Test Atlas Operator Project
     privateEndpoints:
     - provider: "GCP"
       region: "{gcp-region}"
   EOF
   ```

   Atlas creates the VPC (Virtual Private Cloud) resources in the region you selected. This might take several minutes to complete.

2. Find the `{unique-ID}` for your private endpoints.

   Run the following command:

   ```sh
   kubectl get atlasproject my-project -o yaml
   ```

   Note the `{unique-id}` that follows `projects/` in each service attachment name. The `{unique-id}` in the following example is `p-ogyvk1plka2anycnzl6znr9p`.

   **Example**

   ```sh
   "serviceAttachmentNames": [
     "projects/p-ogyvk1plka2anycnzl6znr9p/regions/us-east1/serviceAttachments/sa-us-east1-6274f45bcce0e51662a29b05-0",
     "projects/p-ogyvk1plka2anycnzl6znr9p/regions/us-east1/serviceAttachments/sa-us-east1-6274f45bcce0e51662a29b05-1",
     "projects/p-ogyvk1plka2anycnzl6znr9p/regions/us-east1/serviceAttachments/sa-us-east1-6274f45bcce0e51662a29b05-2",
     "projects/p-ogyvk1plka2anycnzl6znr9p/regions/us-east1/serviceAttachments/sa-us-east1-6274f45bcce0e51662a29b05-3",
     "projects/p-ogyvk1plka2anycnzl6znr9p/regions/us-east1/serviceAttachments/sa-us-east1-6274f45bcce0e51662a29b05-4",
     "projects/p-ogyvk1plka2anycnzl6znr9p/regions/us-east1/serviceAttachments/sa-us-east1-6274f45bcce0e51662a29b05-5"
   ]
   ```

3. Configure your private endpoints.

   To edit the private endpoints and generate the necessary script with the Atlas UI, see [Configure Private Endpoints.](https://www.mongodb.com/docs/atlas/security-configure-private-endpoints.md#std-label-atlas-configure-private-endpoint)

   To configure your private endpoints manually:

   Copy the following shell script:

   ```sh
   #!/bin/bash
   gcloud config set project {google-cloud-project-id}

   for i in {0..5}
   do
     gcloud compute addresses create {private-service-connect-endpoint-prefix}-ip-$i --region={gcp-region} --subnet={subnet-name}
   done

   for i in {0..5}
   do
     if [ $(gcloud compute addresses describe {private-service-connect-endpoint-prefix}-ip-$i --region={gcp-region} --format="value(status)") != "RESERVED" ]; then
       echo "{private-service-connect-endpoint-prefix}-ip-$i is not RESERVED";
     exit 1;
     fi
   done

   for i in {0..5}
   do
     gcloud compute forwarding-rules create {private-service-connect-endpoint-prefix}-$i --region={gcp-region} --network={vpc-name} --address={private-service-connect-endpoint-prefix}-ip-$i --target-service-attachment=projects/{unique-ID}/regions/{gcp-region}/serviceAttachments/sa-{gcp-region}-{org-id}-$i
   done

   if [$(gcloud compute forwarding-rules list --regions={gcp-region} --format="csv[no-heading](name)" --filter="name:{private-service-connect-endpoint-prefix}" | wc -l) -gt 50 ]; then
     echo "Project has too many forwarding rules that match prefix {endpoint-name}. Either delete the competing resources or choose another endpoint prefix."
     exit 2;
   fi

   gcloud compute forwarding-rules list --regions={gcp-region} --format="json(IPAddress,name)" --filter="name:{private-service-connect-endpoint-prefix}" > atlasEndpoints-{endpoint-name}.json
   ```

   Replace the following placeholders with the details about your Google Cloud VPC (Virtual Private Cloud):

   | `google-cloud-project-id` | Unique ID that identifies your Google Cloud project. Find this value on the Dashboard page on your Google Cloud platform. |
   | --- | --- |
   | `private-service-connect-endpoint-prefix` | Human-readable label that prefixes all endpoints created and identifies the endpoint group. |
   | `gcp-region` | Label that identifies the [Google Cloud Platform region](https://www.mongodb.com/docs/atlas/reference/google-gcp.md#std-label-google-gcp) of the private endpoint. |
   | `subnet-name` | Human-readable label that identifies the subnet in your Google Cloud VPC (Virtual Private Cloud). Find this value on the VPC Networks page on your Google Cloud dashboard. |
   | `vpc-name` | Human-readablle label that identifies the VPC (Virtual Private Cloud) that you want to use to connect to Atlas. Find this value on the VPC Networks page on your Google Cloud dashboard. |
   | `unique-id` | Unique string that you noted when you returned the project status. |
   | `org-id` | Unique 24-digit hexadecimal string that identifies the Atlas [organization.](https://www.mongodb.com/docs/atlas/organizations-projects.md#std-label-organizations) |

   Save the shell file as `setup_psc.sh` and run the script from the directory where you saved the file with the following command:

   ```sh
   sh setup_psc.sh
   ```

   The script creates an `atlasEndpoints-{endpoint-name}.json` output file that contains a list of IP addresses and forwarding rule names.

   Run the following commands to format the output for Atlas Kubernetes Operator:

   ```sh
   yq e -P atlasEndpoints-{endpoint-name}.json > atlasEndpoints-user-private-endpoint.yaml
   ```

   ```sh
   awk 'sub("name","endpointName")sub("IPAddress","ipAddress")' atlasEndpoints-user-private-endpoint.yaml
   ```

   The output shoud resemble the following example:

   ```sh
   - ipAddress: 10.0.0.00
     endpointName: {endpoint-name}-0
   - ipAddress: 10.0.0.01
     endpointName: {endpoint-name}-1
   - ipAddress: 10.0.0.02
     endpointName: {endpoint-name}-2
   - ipAddress: 10.0.0.03
     endpointName: {endpoint-name}-3
   - ipAddress: 10.0.0.04
     endpointName: {endpoint-name}-4
   - ipAddress: 10.0.0.05
     endpointName: {endpoint-name}-5
   ```

4. Update the `spec.privateEndpoints` parameter.

   Update the [spec.privateEndpoints](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-spec-privateendpoints) parameter for the [`AtlasProject` Custom Resource](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource). Specify the [Google Cloud Platform region](https://www.mongodb.com/docs/atlas/reference/google-gcp.md#std-label-google-gcp), Google Cloud Project ID, Private Service Endpoint Prefix, your output information, and run the following command:

   ```sh
   cat <<EOF | kubectl apply -f -
   apiVersion: atlas.mongodb.com/v1
   kind: AtlasProject
   metadata:
     name: my-project
   spec:
     name: Test Atlas Operator Project
     privateEndpoints:
     - provider: "GCP"
       region: "{gcp-region}"
       gcpProjectId: "{project-id}"
       endpointGroupName: "{endpoint-name}"
       endpoints:
       - ipAddress: {ip-address}
         endpointName: {endpoint-name}-0
       - ipAddress: {ip-address}
         endpointName: {endpoint-name}-1
       - ipAddress: {ip-address}
         endpointName: {endpoint-name}-2
       - ipAddress: {ip-address}
         endpointName: {endpoint-name}-3
       - ipAddress: {ip-address}
         endpointName: {endpoint-name}-4
       - ipAddress: {ip-address}
         endpointName: {endpoint-name}-5
   EOF
   ```

5. Check the status of your private endpoints using Atlas Kubernetes Operator.

   Run the following command:

   ```sh
   kubectl get atlasproject my-project -o yaml
   ```

6. Retrieve the secret that Atlas Kubernetes Operator created to connect to the cluster.

   Copy the following command:

   **Important:**

   The following command requires `jq` 1.6 or higher.

   ```sh
   kubectl get secret {my-project}-{my-atlas-cluster}-{my-database-user} -o json | jq -r '.data | with_entries(.value |= @base64d)';
   ```

   Replace the following placeholders with the details for your custom resources:

   | `my-project` | Specify the value of the `metadata` field of your [`AtlasProject` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasproject-custom-resource.md#std-label-atlasproject-custom-resource) |
   | --- | --- |
   | `my-atlas-cluster` | Specify the value of the `metadata` field of your [`AtlasDeployment` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasdeployment-custom-resource.md#std-label-atlasdeployment-custom-resource) |
   | `my-database-user` | Specify the value of the `metadata` field of your [`AtlasDatabaseUser` Custom Resource.](https://www.mongodb.com/docs/atlas/operator/current/atlasdatabaseuser-custom-resource.md#std-label-atlasdatabaseuser-custom-resource) |

   Run the command.

   **Note:**

   Your connection strings will differ from the following example. If you have multiple private endpoints, the secret contains multiple `connectionStringPrivate` and `connectionStringPrivateSvr` fields with the appropriate numeric suffix (for example, `connectionStringPrivate1`, `connectionStringPrivate2`, and so on).

   ```sh
   {
     "connectionStringPrivate": "mongodb://pl-0-eastus2.uzgh6.mongodb.net:1024,pl-0-eastus2.uzgh6.mongodb.net:1025,pl-0-eastus2.uzgh6.mongodb.net:1026/?ssl=truereplicaSet=atlas-18bndf-shard-0",
     "connectionStringPrivateSrv": "mongodb+srv://cluster0-pl-0.uzgh6.mongodb.net",
     "password": "P@@sword%",
     "username": "theuser"
    }
   ```

   You can use this [secret](https://kubernetes.io/docs/concepts/configuration/secret/) in your application:

   ```sh
   containers:
     - name: test-app
       env:
       - name: "CONNECTION_STRING"
         valueFrom:
           secretKeyRef:
             name: my-project-my-atlas-cluster-my-database-user
             key: connectionStringPrivate
   ```