GCP for DevOps — Shared VPC & Peering

3 minute read

Shared VPC & Peering

As your GCP footprint grows across multiple projects, you need a strategy for connecting them. GCP offers two main approaches: Shared VPC (centralized networking) and VPC Peering (decentralized connectivity).

Shared VPC

Shared VPC allows an organization to connect resources from multiple service projects to a common host project’s VPC network.

┌─────────────────────────────────────────────────────────┐
│                     Organization                         │
│                                                         │
│  ┌─────────────────────────────────────────────┐        │
│  │          Host Project (network-hub)          │        │
│  │                                              │        │
│  │  ┌──────── Shared VPC ──────────────────┐   │        │
│  │  │  Subnet-web:  10.1.0.0/24            │   │        │
│  │  │  Subnet-app:  10.2.0.0/24            │   │        │
│  │  │  Subnet-db:   10.3.0.0/24            │   │        │
│  │  │  Firewall rules, Cloud NAT, Router   │   │        │
│  │  └──────────────────────────────────────┘   │        │
│  └──────────────┬──────────────┬───────────────┘        │
│                 │              │                         │
│     ┌───────────▼──┐  ┌───────▼───────────┐            │
│     │ Service Proj │  │ Service Proj      │            │
│     │ (team-a)     │  │ (team-b)          │            │
│     │              │  │                   │            │
│     │ VMs use      │  │ GKE uses          │            │
│     │ Subnet-web   │  │ Subnet-app        │            │
│     └──────────────┘  └───────────────────┘            │
└─────────────────────────────────────────────────────────┘

Setting Up Shared VPC

# Step 1: Enable Shared VPC on the host project
$ gcloud compute shared-vpc enable network-hub

# Step 2: Associate service projects
$ gcloud compute shared-vpc associated-projects add team-a \
    --host-project=network-hub

$ gcloud compute shared-vpc associated-projects add team-b \
    --host-project=network-hub

# Step 3: Grant subnet access to service project users
$ gcloud projects add-iam-policy-binding network-hub \
    --member="serviceAccount:team-a@team-a.iam.gserviceaccount.com" \
    --role="roles/compute.networkUser"

# Or grant access to a specific subnet only
$ gcloud compute networks subnets add-iam-policy-binding subnet-web \
    --region=us-central1 \
    --member="serviceAccount:team-a@team-a.iam.gserviceaccount.com" \
    --role="roles/compute.networkUser" \
    --project=network-hub

# Step 4: Create a VM in a service project using the shared subnet
$ gcloud compute instances create web-vm \
    --project=team-a \
    --zone=us-central1-a \
    --machine-type=e2-medium \
    --subnet=projects/network-hub/regions/us-central1/subnetworks/subnet-web

VPC Peering

VPC Peering connects two VPC networks so they can communicate using internal IPs. Peering is non-transitive — if VPC-A peers with VPC-B, and VPC-B peers with VPC-C, VPC-A cannot reach VPC-C through VPC-B.

┌──────────────┐          ┌──────────────┐
│  VPC-A       │  Peering │  VPC-B       │
│  10.1.0.0/16 │◄────────►│  10.2.0.0/16 │
│  (Project A) │          │  (Project B) │
└──────────────┘          └──────┬───────┘
                                 │ Peering
                          ┌──────▼───────┐
                          │  VPC-C       │
                          │  10.3.0.0/16 │
                          │  (Project C) │
                          └──────────────┘

VPC-A ↔ VPC-B  ✅ Can communicate
VPC-B ↔ VPC-C  ✅ Can communicate
VPC-A ↔ VPC-C  ❌ NOT transitive

Setting Up VPC Peering

# Create peering from VPC-A to VPC-B
$ gcloud compute networks peerings create peer-a-to-b \
    --network=vpc-a \
    --peer-network=vpc-b \
    --peer-project=project-b \
    --export-custom-routes \
    --import-custom-routes

# Create peering from VPC-B to VPC-A (must be bidirectional)
$ gcloud compute networks peerings create peer-b-to-a \
    --network=vpc-b \
    --peer-network=vpc-a \
    --peer-project=project-a \
    --export-custom-routes \
    --import-custom-routes

# Verify peering status
$ gcloud compute networks peerings list --network=vpc-a

NAME           NETWORK  PEER_PROJECT  PEER_NETWORK  STATE   IMPORT_CUSTOM_ROUTES
peer-a-to-b    vpc-a    project-b     vpc-b         ACTIVE  True

Shared VPC vs VPC Peering

Feature Shared VPC VPC Peering
Network topology Centralized (one VPC) Decentralized (separate VPCs)
Network admin Host project controls networking Each project manages its own
Transitivity N/A (same VPC) Not transitive
IP overlap Not possible (same VPC) Not allowed for peered VPCs
Firewall rules Centralized in host project Each VPC has its own rules
Org requirement Must be in same org Can be cross-org
Max connections 1 host + 100 service projects 25 peering connections per VPC
Best for Centralized network management Connecting independent projects

When to Use What

┌────────────────────────────┐
│ Need centralized network   │
│ control?                   │
│                            │
│  Yes → Shared VPC          │
│  No  → VPC Peering         │
└────────────────────────────┘

┌────────────────────────────┐
│ Same organization?         │
│                            │
│  Yes → Either works        │
│  No  → VPC Peering only    │
└────────────────────────────┘

┌────────────────────────────┐
│ Need more than 25          │
│ connections?               │
│                            │
│  Yes → Shared VPC          │
│  No  → Either works        │
└────────────────────────────┘

Common Mistakes

Mistake Why It’s Wrong Fix
Overlapping IP ranges for peering Peering fails Plan non-overlapping IP ranges
Expecting peering to be transitive VPC-A can’t reach VPC-C via VPC-B Use hub-spoke with Shared VPC
Not granting compute.networkUser Service projects can’t use shared subnets Grant per subnet or project
Missing bidirectional peering Only one side is configured Create peering in both directions
Too many separate VPCs Complex peering mesh Consolidate with Shared VPC

Quick Reference

Command Description
gcloud compute shared-vpc enable PROJECT Enable Shared VPC host
gcloud compute shared-vpc associated-projects add PROJ --host-project=HOST Add service project
gcloud compute networks peerings create NAME --network=VPC --peer-network=PEER Create peering
gcloud compute networks peerings list --network=VPC List peerings
gcloud compute networks peerings delete NAME --network=VPC Delete peering

Next → Practice Exercises

Updated:

You may also enjoy