Operator Guide for gcp-global-network

Google Cloud Virtual Private Cloud (VPC) creates a private cloud as an abstraction on Google Cloud’s physical infrastructure. VPC provides secure network isolation across regions along with the ability to adjust the IP space on the fly.

Use Cases

General Compute

VPC is vital to running almost anything on Google Cloud.

Configuration Presets

Private

This is our only guided configuration for the global network. It sets Classless Inter-Domain Routing (CIDR) blocks for Private Service Connect and Private services access.

Design

The gcp-global-network bundle creates a VPC. It is the global parent for everything that needs network access. You will end up connecting bundles to gcp-subnetwork most of the time, with that subnetwork connected to the global network (cluster → subnetwork → global-network). You cannot run anything in a VPC without a subnetwork. The subnetwork defines the IP range.

Private Service Connect

Private Service Connect improves security by allowing you to access GCP APIs across VPCs without traversing the public Internet.

Private Services Access

Private services access allows GCP services (such as CloudSQL and Memorystore) to be offered through a single peering connection with an internal IP address so that each instance does not consume its own peering connection. This is important since GCP global networks have a peering limit of only 25 connections. You may choose the CIDR blocks for Private Service Connect and private services access, but we do not allow you to turn them off.

Best Practices

Security

Massdriver allocates a range for private services access so that you can launch private Google Cloud Platform (GCP) services without individual peering connections. See documentation here for more information.

Private Service Connect

Private Service Connect lowers network egress costs and latency. You also benefit from the improved security of private networking.

Private Services Access

The peering limit of 25 often becomes a major issue for companies because it limits service scaling. Because private services access routes GCP services through a single peering connection, you can scale larger without hitting the peering limit.

Trade-offs

VPC Flow Logs are not turned on or configurable by this bundle. Even on medium-sized networks, they incur a large cost.