I am building a Cloud SQL instance without a public IP address. While I was able to successfully setup the private service access for the instance, I did not understand the distinction between “Customer VPC network” and “Service producer VPC network” in the following diagram shown in this page: https://cloud.google.com/sql/docs/postgres/private-ip

The same page explains:

Private services access lets you create private connections between your VPC network and the underlying Google service producer’s VPC network

My question is, why is there a difference between the two VPC networks? Since both customer and service producer VPC are ultimately resources owned by Google Cloud, why can’t they put it in the same VPC network dedicated to my project?

I wasn’t able to find an explanation for why my VM needs to live in the “Customer VPC network”, while my Cloud SQL instance cannot.