GCP for DevOps — VPC Basics

2 minute read

VPC Basics

A Virtual Private Cloud (VPC) is a global virtual network in GCP. Unlike AWS VPCs (which are regional), a GCP VPC spans all regions automatically. Subnets within the VPC are regional.

VPC Modes

Mode Description Subnets Use Case
Auto mode Creates one subnet per region automatically Auto-created with /20 ranges Dev/test, quick start
Custom mode You define all subnets manually You choose IP ranges Production, full control

⚠️ DevOps Best Practice: Always use custom mode VPCs in production. Auto mode uses predefined IP ranges that may conflict with other networks.

Creating a VPC

# Create a custom mode VPC
$ gcloud compute networks create prod-vpc \
    --subnet-mode=custom \
    --bgp-routing-mode=regional \
    --description="Production VPC"

Created [prod-vpc].
NAME      SUBNET_MODE  BGP_ROUTING_MODE  IPV4_RANGE  GATEWAY_IPV4
prod-vpc  CUSTOM       REGIONAL

# Create an auto mode VPC (not recommended for production)
$ gcloud compute networks create dev-vpc \
    --subnet-mode=auto

# Convert auto mode to custom mode (irreversible)
$ gcloud compute networks update dev-vpc \
    --switch-to-custom-subnet-mode

Creating Subnets

# Create subnets in different regions
$ gcloud compute networks subnets create prod-us-central \
    --network=prod-vpc \
    --region=us-central1 \
    --range=10.1.0.0/24 \
    --enable-private-ip-google-access \
    --enable-flow-logs

Created [prod-us-central].

$ gcloud compute networks subnets create prod-us-east \
    --network=prod-vpc \
    --region=us-east1 \
    --range=10.2.0.0/24 \
    --enable-private-ip-google-access

$ gcloud compute networks subnets create prod-europe \
    --network=prod-vpc \
    --region=europe-west1 \
    --range=10.3.0.0/24 \
    --enable-private-ip-google-access

# List subnets
$ gcloud compute networks subnets list --network=prod-vpc \
    --format="table(name,region,ipCidrRange,privateIpGoogleAccess)"

NAME              REGION         IP_CIDR_RANGE  PRIVATE_IP_GOOGLE_ACCESS
prod-us-central   us-central1    10.1.0.0/24    True
prod-us-east      us-east1       10.2.0.0/24    True
prod-europe       europe-west1   10.3.0.0/24    True

Secondary IP Ranges (for GKE)

GKE requires secondary IP ranges for pods and services.

# Create a subnet with secondary ranges for GKE
$ gcloud compute networks subnets create gke-subnet \
    --network=prod-vpc \
    --region=us-central1 \
    --range=10.10.0.0/24 \
    --secondary-range=pods=10.100.0.0/16,services=10.200.0.0/20 \
    --enable-private-ip-google-access

# Verify secondary ranges
$ gcloud compute networks subnets describe gke-subnet \
    --region=us-central1 \
    --format="yaml(ipCidrRange,secondaryIpRanges)"

ipCidrRange: 10.10.0.0/24
secondaryIpRanges:
- ipCidrRange: 10.100.0.0/16
  rangeName: pods
- ipCidrRange: 10.200.0.0/20
  rangeName: services

Private Google Access

Allows VMs without external IPs to access Google APIs and services.

# Enable Private Google Access on a subnet
$ gcloud compute networks subnets update prod-us-central \
    --region=us-central1 \
    --enable-private-ip-google-access

# Verify
$ gcloud compute networks subnets describe prod-us-central \
    --region=us-central1 \
    --format="get(privateIpGoogleAccess)"

True

VPC Flow Logs

Capture network flow information for monitoring and troubleshooting.

# Enable flow logs on a subnet
$ gcloud compute networks subnets update prod-us-central \
    --region=us-central1 \
    --enable-flow-logs \
    --logging-aggregation-interval=INTERVAL_5_SEC \
    --logging-flow-sampling=0.5 \
    --logging-metadata=INCLUDE_ALL

# View flow logs in Cloud Logging
$ gcloud logging read 'resource.type="gce_subnetwork" AND logName:"vpc_flows"' \
    --project=my-project --limit=5

Routing

# List routes for a VPC
$ gcloud compute routes list --filter="network:prod-vpc" \
    --format="table(name,network,destRange,nextHopGateway)"

# Create a custom static route
$ gcloud compute routes create route-to-onprem \
    --network=prod-vpc \
    --destination-range=192.168.0.0/16 \
    --next-hop-vpn-tunnel=my-vpn-tunnel \
    --priority=1000

Common Mistakes

Mistake Why It’s Wrong Fix
Using auto mode VPC for production IP ranges may conflict Use custom mode
Overlapping IP ranges Can’t peer networks Plan IP addressing in advance
Not enabling Private Google Access Private VMs can’t reach Google APIs Always enable on production subnets
Large subnets (/16) Wastes IP space, hard to manage Use smallest range needed
Not enabling flow logs Can’t debug network issues Enable on production subnets

Quick Reference

Command Description
gcloud compute networks create NAME --subnet-mode=custom Create custom VPC
gcloud compute networks subnets create NAME --network=VPC --region=R --range=CIDR Create subnet
gcloud compute networks subnets list --network=VPC List subnets
gcloud compute networks subnets update NAME --enable-private-ip-google-access Enable PGA
gcloud compute routes list --filter="network:VPC" List routes

Next → Subnets & Firewall

Updated:

You may also enjoy