1. VPC and subnets #
A global network.
Principles #
gcloud compute networks create prod --subnet-mode=custom
gcloud compute networks subnets create paris --network=prod --region=europe-west9 --range=10.10.0.0/20 --enable-private-ip-google-access
gcloud compute routers create r-paris --network=prod --region=europe-west9
gcloud compute routers nats create nat-paris --router=r-paris --region=europe-west9 --auto-allocate-nat-external-ips --nat-all-subnet-ip-ranges2. Firewall #
Rules at the VPC level.
Rules #
VPC firewall rules apply to VMs based on network tags or service accounts, with priority, direction (ingress/egress) and action. Hierarchical firewall policies apply to a whole organization or folder.
gcloud compute firewall-rules create autoriser-lb-web --network=prod --direction=INGRESS --action=allow \
--rules=tcp:8080 --source-ranges=35.191.0.0/16,130.211.0.0/22 --target-service-accounts=web@mon-projet.iam.gserviceaccount.comHealth checks: The 35.191.0.0/16 and 130.211.0.0/22 ranges are those used by Google's health checks and load balancers.
3. Load balancing and connectivity #
Exposing and connecting.
Services #
| Need | Service |
|---|---|
| Global web application | Global external application load balancer + Cloud CDN + Cloud Armor |
| Regional TCP/UDP traffic | Network load balancer |
| Several projects, one common network | Shared VPC |
| Private access to managed services | Private Service Connect |
| Connecting the company site | Cloud VPN (HA VPN) or Cloud Interconnect |
