Shared VPC
1. Shared VPC
In this module, we are going to cover two configurations for sharing VPC networks across Google Cloud Projects. First, we will go over shared VPC, which allows you to share a network across several projects in your Google Cloud organization. Then we will go over VPC Network Peering, which allows you to configure private communication across projects in the same or different organizations. Let's start by talking about shared VPC. Kim is a network administrator at Symbol Corporation. Symbol has four networks that belong to the Web application servers project, namely the recommendation, personalization, analytics, and web. The recommendation service, the personalization service, and the analytics service are each hosted on a different VPC. In this model, Kim is facing challenges such as time consuming management of network, difficulty scaling, and limitation communicating between networks. In addition to this, it is a constant turn to set up access policy, new projects, billing, etc. Kim would like to centrally manage the VPC networks while still segregating workloads that use these networks. What should Kim do? Kim can benefit by implementing shared VPC among these networks. When you use shared VPC, you designate a project as a host project and attach one or more other service projects to it. In this case, the web application servers project is the host project, and the three other projects are the service projects. The overall VPC network is called the Shared VPC network. Shared VPC makes use of Cloud IAM roles for delegated administration. Let me walk through how to provision shared VPC by focusing on the required administrative roles. The first required role is the organization administrator. The organization resource represents an organization, for example, a company, and is the root node in the Google Cloud Resource hierarchy. The Google Workplace or Cloud Identity Super administrators are the first users who can access the organization, and they assign the organization Admin role to users. The organization Admins role in provisioning shared VPC is to nominate shared VPC admins by granting them appropriate project creation and deletion roles, and the compute.xpnAdmin role for the organization. Note that shared VPC is also referred to as XPN in the API and command line interface. Next, the shared VPC administrator performs various tasks necessary to set up shared VPC, such as enabling shared VPC on the host project, attaching service projects to the host project, and delegating access to some or all of the subnets in shared VPC networks to service project Admins by granting the compute.networkUser role. Typically, a shared VPC administrator is also the project owner for a given host project. In addition to being a network user, service project administrators also maintain ownership and control over resources defined in their service projects. The service project administrators must at least have the compute.instanceAdmin role to the corresponding service project. However, typically, the service project administrators are project owners of their service projects. This allows them to create and manage resources in the shared VPC. These resources could be VM instances, instance templates and groups, static internal IP addresses, and load balancers. Let's come back to our original example that had one host project and three service projects. In this diagram, the Shared VPC administrator, which was nominated by an organization administrator, configured the web application project to be a host project with subnet-level permissions. Doing so allowed the shared VPC administrator to selectively share subnets from the VPC network. Next, the shared VPC administrator attached the three service projects to the host project and gave each project owner the network user role for the corresponding subnets. Each project owner then created VM instances from their service projects in the shared subnets. By the way, billing for those VM instances is attributed to the project where the resources are created, which are the service projects. Shared VPC administrators have full control over the resources in the host project, including administration of the shared VPC network. They can optionally delegate the network administrator and security administrator roles for the host project. Overall, shared VPC is a centralized approach to multi-project networking because security and network policy occurs in a single designated VPC network.2. Let's practice!
Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.