TopolearnProduction designs remove external IPs; you then need these pieces for outbound traffic, Google APIs and managed services.
Once VMs, GKE nodes and serverless egress have no external IPs, several services fill the gaps:
- Cloud NAT: managed outbound NAT per region, configured on a Cloud Router. Private VMs can download packages and call third-party APIs; nothing can connect in.
- Private Google Access (a subnet flag): private VMs reach Google APIs such as Cloud Storage without NAT.
- Private services access: a VPC peering to a Google-managed network, used to give Cloud SQL, AlloyDB or Memorystore a private IP in your address space. You reserve an IP range for it.
- Private Service Connect (PSC): expose a service as an endpoint IP inside a consumer VPC, for Google APIs or for services published by another team or vendor. Unlike peering, it does not merge address spaces.
- Direct VPC egress (or Serverless VPC Access connectors) lets Cloud Run send traffic into a VPC.
To share one network across many projects, use Shared VPC: a host project owns the VPC and subnets; service projects create VMs and services in those subnets. Network admins control IPs and firewalls centrally while app teams own their projects; grant roles/compute.networkUser per subnet.
VPC Network Peering connects two VPCs privately but is non-transitive: if A peers with B and B with C, A cannot reach C.
Example
# Outbound internet for private VMs in europe-west1
gcloud compute routers create shop-router --network=shop-vpc --region=europe-west1
gcloud compute routers nats create shop-nat --router=shop-router --region=europe-west1 \
--auto-allocate-nat-external-ips --nat-all-subnet-ip-ranges
# Google APIs without NAT
gcloud compute networks subnets update shop-euw1 --region=europe-west1 \
--enable-private-ip-google-access
# Private IP range for managed services (Cloud SQL, AlloyDB...)
gcloud compute addresses create google-managed --global --purpose=VPC_PEERING \
--prefix-length=16 --network=shop-vpc
gcloud services vpc-peerings connect --service=servicenetworking.googleapis.com \
--ranges=google-managed --network=shop-vpcRemember
- Cloud NAT gives outbound-only internet to private workloads
- Private Google Access is a subnet setting for Google APIs
- Shared VPC: central host project, app teams in service projects
- Peering is non-transitive; PSC avoids merging address spaces
Watch out for
- Expecting traffic to flow A to C through a shared peered VPC B.