Create a producer VPC spoke

This page describes how to create a producer Virtual Private Cloud (VPC) spoke on a Network Connectivity Center hub.

For an overview of producer VPC spokes, see Producer VPC spokes.

Before you begin

Before you create a producer VPC spoke:

Review the Considerations for producer VPC spokes.
Review the guidelines for creating VPC spokes, which also apply to producer VPC spokes.

Create a producer VPC spoke

Permissions required for this task

To perform this task, you must have been granted the following permissions or the following IAM roles.

Permissions

networkconnectivity.spokes.use on the peered consumer VPC spoke
networkconnectivity.groups.use on the hub that the spoke is being associated with
networkconnectivity.spokes.create in the project where the peered consumer VPC network lives
networkconnectivity.groups.create on the hub to create a group
networkconnectivity.groups.use on the hub to create spokes associated with a group in a different project from the hub

Roles

Compute Network Admin role (roles/compute.networkAdmin) on the peered consumer VPC network
Spoke Admin role (roles/networkconnectivity.spokeAdmin) in the project where the peered consumer VPC network lives

To connect a service producer VPC network with other networks in a given project, connect the producer VPC network to a producer VPC spoke, and connect the producer VPC spoke to a hub.

If you use the Google Cloud CLI or the API to connect the producer VPC spoke to a hub that is configured for star topology, you must use the same group name as the existing consumer VPC spoke on the hub. If you use the Google Cloud console, the producer VPC spoke is automatically added to the same group.

If you want to assign exclude export ranges or include export ranges, use the appropriate options during spoke creation.

To create a producer VPC spoke, follow these steps.

Console

In the Google Cloud console, go to the Network Connectivity Center page.

Go to Network Connectivity Center
In the project menu, select a project in which you want to create the spoke.
Click the Spokes tab.
Click Add spokes.
In the Select hub section, select the hub location as follows:
- To attach the new spoke to a hub in the same project, select In project PROJECT_NAME and select the hub name from the list.
- If you want to attach the new spoke to a hub in another project, select In another project. Enter the Project ID and the Hub name to which you want to attach your new spoke.
When you choose a hub in a different project, your spoke becomes active only when the hub administrator reviews and accepts your proposed spoke. For more information about creating spokes attached to a hub in a different project, see VPC spokes overview. If you are creating a producer VPC spoke in the same project as the hub, the producer VPC spoke is automatically accepted and activated.
Enter a Spoke name and optionally, a Description.
Select Producer VPC network as the Spoke type.
Enter the name of an existing Consumer VPC spoke on the hub that consumes services from the producer VPC network through a VPC Network Peering connection. Google Cloud identifies the producer network through the peering connection.
Optionally, you can add a VPC spoke filter to customize how routes are advertised by entering an IP address range to exclude or include export from the spoke to hub. You cannot change this filter after the spoke is created.
Click Done.
If you want to add more spokes, click Add spoke and begin the process again, starting with entering a spoke name.
When you have finished adding spokes, click Create. The Network Connectivity Center page updates to show details about the spokes that you created.

gcloud

To create a producer VPC spoke, use the gcloud network-connectivity spokes linked-producer-vpc-network create command.

gcloud network-connectivity spokes linked-producer-vpc-network create SPOKE_NAME \
    --hub=HUB \
    --description=DESCRIPTION \
    --network=CONSUMER_VPC_URI \
    --peering=servicenetworking-googleapis-com \
    --exclude-export-ranges=[EXCLUDE_CIDR_RANGE] \
    --include-export-ranges=[INCLUDE_CIDR_RANGE] \
    --global \
    --group=GROUP_NAME

The --peering flag must be set to servicenetworking-googleapis-com.

Replace the following:

SPOKE_NAME: the name of the spoke that you are creating, such as producer-vpc-spoke1
HUB: the hub for the spoke
DESCRIPTION: optional text to describe the spoke
CONSUMER_VPC_URI: the VPC network that consumes services from the producer network through a VPC Network Peering connection. Google Cloud identifies the producer VPC network through the peering connection. The consumer network that you enter must also be a spoke in the hub. You can enter the full or relative URI. The following example shows the relative URI: projects/PROJECT_ID/global/networks/NETWORK_NAME.
[EXCLUDE_CIDR_RANGE]: a comma-separated list of IP address ranges to be excluded from exporting to the hub—up to 16 CIDR ranges—such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32. The specified ranges must have a longer prefix or be equal to the individually configured subnets within the producer VPC.
[INCLUDE_CIDR_RANGE]: a comma-separated list of IP address ranges to be included in exporting to the hub—up to 16 CIDR ranges—such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32.
GROUP_NAME: the group this spoke belongs to—for example, center or edge. This field is required for spoke groups that use star topology. If using the star topology, you must place the producer VPC spoke in the same group as the existing consumer VPC spoke. For more information about spoke groups, see Spoke groups.

API

To create a producer VPC spoke, use the networkconnectivity.spokes.create method.

  POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/spokes/SPOKE_NAME
  {
    "hub":"HUB_NAME",
    "linkedProducerVpcNetwork": {
       "network": "CONSUMER_VPC_URI",
       "peering_name": "servicenetworking-googleapis-com",
       "include_export_ranges": "[INCLUDE_CIDR_RANGE]",
       "exclude_export_ranges": "[EXCLUDE_CIDR_RANGE]",
       "group": "GROUP_NAME"
    },
  }

The peering_name field must be set to servicenetworking-googleapis-com.

Replace the following values:

PROJECT_ID: the project ID of the project that contains the new spoke.
HUB_NAME: the name of the hub that you are attaching the spoke to.
SPOKE_NAME: the name of the spoke that you are creating.
CONSUMER_VPC_URI: the VPC network that consumes services from the producer through a VPC Network Peering connection. Google Cloud identifies the producer VPC network through the peering connection. The consumer network that you enter must also be a spoke in the hub. You can enter the full or relative URI. The following example shows the relative URI: projects/PROJECT_ID/global/networks/NETWORK_NAME.
[INCLUDE_CIDR_RANGE]: a comma-separated list of IP address ranges to be included in exporting to the hub—up to 16 CIDR ranges—such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32. The specified ranges must have a longer prefix or be equal to the individually configured subnets within the producer VPC network.
[EXCLUDE_CIDR_RANGE]: a comma-separated list of IP address ranges to be excluded from exporting to the hub—up to 16 CIDR ranges—such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32.
GROUP_NAME: the group that this spoke belongs to. Supported values are default for a mesh topology hub and center or edge for a star topology hub. This field is required for spoke groups that use star topology. If using the star topology, you must place the producer VPC spoke in the same group as the existing consumer VPC spoke. For more information about spoke groups, see Spoke groups.

Create a producer VPC spoke

Before you begin

Create a producer VPC spoke

Permissions required for this task

Console

gcloud

API

What's next