we want to use Private Custom training from Vertex AI, which requires /16 IP allocation for Private Service Access. We need this to be routable to our on-premises network (connected via hub-and-spoke architecture - https://cloud.google.com/architecture/deploy-hub-spoke-vpc-network-topology). We can't allocate fully routable range, as our IP space is fragmented. We want to SNAT the traffic from Vertex AI so it can be hidden behind single IP and reach on-premise. However we want to avoid spinning Linux VM and doing SNAT there via iptables and we look for "managed" solution.
We explored Private Service Connect, however the PSC endpoints are not reachable from peered VPC networks. (https://cloud.google.com/vpc/docs/configure-private-service-connect-services#limitations )
Is there any other way to connect Google VPC-peered resources other than doing it via Linux VM NAT instance (as described in https://cloud.google.com/blog/products/ai-machine-learning/extending-network-reachability-of-vertex-pipelines )