TopolearnEvery VM, GKE node and private database address comes from a VPC subnet, so its design is hard to change later.
A VPC network in Google Cloud is global: one network spans all regions, and VMs in different regions can talk over internal IPs without VPNs. Subnets are regional and own a primary IPv4 range (plus optional secondary ranges, used e.g. by GKE Pods and Services).
Two creation modes:
- Auto mode creates one subnet per region from a fixed
10.128.0.0/9block. Thedefaultnetwork in new projects is auto mode with permissive firewall rules. Fine for experiments. - Custom mode creates no subnets; you add exactly the ranges you plan. Use this for anything real, so ranges do not collide with on-premises or other VPCs you may later connect.
Addresses: each VM NIC gets an internal IP from its subnet; an external IP is optional (ephemeral or reserved static). VMs without external IPs can still reach the internet through Cloud NAT and Google APIs through Private Google Access.
Routes are also global. Every network has system routes for its subnets and a default route 0.0.0.0/0 to the internet gateway; custom routes and Cloud Router (BGP) cover VPNs and interconnects.
A project can hold several VPCs, but they are isolated from each other unless you connect them (peering, VPN, Shared VPC, Network Connectivity Center).
Example
gcloud compute networks create shop-vpc --subnet-mode=custom
gcloud compute networks subnets create shop-euw1 --network=shop-vpc \
--region=europe-west1 --range=10.10.0.0/20
gcloud compute networks subnets create shop-use1 --network=shop-vpc \
--region=us-east1 --range=10.20.0.0/20
gcloud compute networks subnets list --network=shop-vpc
# NAME REGION NETWORK RANGE
# shop-euw1 europe-west1 shop-vpc 10.10.0.0/20
# shop-use1 us-east1 shop-vpc 10.20.0.0/20
gcloud compute routes list --filter="network:shop-vpc" --format="value(destRange,nextHopGateway.basename())"Remember
- VPC networks and routes are global; subnets are regional
- Use custom mode and plan non-overlapping ranges
- External IPs are optional; private VMs use NAT and Private Google Access
Watch out for
- Building production on the auto-mode default network, whose ranges overlap every other default network you might later peer with.