In Google Cloud, we were using the Shared VPC network model to enable management and isolate workloads in separate VPC Networks, but we have one more option for centralized management. It is Hub & Spoke!
What is Hub VPC?
- Hub & Spoke uses a central hub VPC and it’s connected to multiple Spoke VPC via peering and VPN
- It contains network resources and is shared with Spoke VPCs (firewall, VPN gateways, Cloud DNS.)
- You can connect via a single VPC (Hub) with your on-prem or other public cloud provider.
What is Spoke VPC?
- Each spoke VPC network is connected to a central hub VPC network. Also, spokes can contain network resources like FW rules, cloud nat, or Cloud DNS.
- Can contain a shared VPC or can be a service project with its own VPC.
Which connection types are available between the Hub and Spoke?
In this architecture, you have one hub and two spoke environments.
The HUB VPC centralizes external connectivity to on-premises or other cloud environments. For example, if you are going to set up S2S VPN between your on-premises and Google Cloud, you do it with Hub VPC. Or, if you need to resolve your local private DNS records, you can add cloud DNS forwarding to the hub project.
The spoke VPCs allow partitioning workloads.
With Peering;
This design has just one difference from “Hub and spoke with a VPN.” Connectivity between hubs and spokes is established here via VPC peering, which offers complete isolation between environments.
- Pros: no additional costs, full bandwidth with no configurations, no extra latency, total environment isolation
- Cons: no transitivity (e.g., to GKE masters, Cloud SQL, etc.), no selective exchange of routes, several quotas and limits shared between VPCs in a peering group
Think about it: you already have HA VPN between the on-prem and hub networks, and you also have 2 more VPCs. Each VPC has its own VPN Tunnels and you would like to use them in the GCP Hub and Spoke Environment. Tunnels names are tunnel-1–1, tunnel-1–2, tunnel-2–1, tunnel-2–2, tunnel-on-prem-1–1, tunnel-on-prem-1–2
So, how do you make a Hub and Spoke system?
Before beginning, you have to set up the project in your shell.
gcloud config
set
project PROJECT_ID
Required Permissions
- Hub and Spoke Admin
- Compute Network Viewer (if you are working in the GCP Console)
- Network Connectivity Center API.
- Go to the Network Connectivity Center
2. Click Enable the Network Connectivity API
Create Hub
In the Hub project, first, create a network connectivity hub.
gcloud network-connectivity hubs
create
hub-test – description=Test_hub
Create Spoke for each VPC Also, don’t forget that you already configured HA VPN between Hub Project and other projects.
Use the site-to-site-data-transfer flag if you want to enable data transfer for the spoke
gcloud network-connectivity spokes linked-vpn-tunnels
create
spoke-on-prem
–hub=hub-test
–description=Spoke1
–vpn-tunnel=tunnel1-1,tunnel1-2
–region=Region1
–site-to-site-data-transfer
gcloud network-connectivity spokes linked-vpn-tunnels create spoke1 –hub=hub-test –description=Spoke1 –vpn-tunnel=tunnel1-1,tunnel1-2 –region=us-west2
gcloud network-connectivity spokes linked-vpn-tunnels create spoke2 –hub=transit-hub –description=Spoke2 –vpn-tunnel=tunnel2-1,tunnel2-2 –region=us-west1
List VPN Spokes
After the creation, you can list existing spokes in the regions.
gcloud network-connectivity spokes list
–region=us-west1
Now you can test the connection from on-prem to any spoke vpc’s VM or between spoke projects.
Useful links;
https://cloud.google.com/architecture/deploy-hub-spoke-vpc-network-topology
GitHub – GoogleCloudPlatform/cloud-foundation-fabric: End-to-end modular samples and landing zones…
End-to-end modular samples and landing zones toolkit for Terraform on GCP. – GitHub …
github.com
Author: Azir Güleroğlu, Staff Cloud&Devops Engineer, Oredata
Oredata is a premier Google Cloud Partner specialized in
- Cloud Migration Services
- Data & Analytics Services
- Infrastructure Services
- Google Workspace
If you are interested joining us, feel free to apply our job openings: https://www.linkedin.com/company/oredata/jobs/
