Propose a VPC spoke in a different project

When you create a spoke, you must associate it with a hub. If your spoke is in a different project from the hub, the hub administrator must approve your proposed spoke before it can become active. To create a VPC spoke that you want to connect to a hub in a different project, follow these steps.

For information about how to work with spokes including creating, listing, updating, and deleting spokes, see Work with spokes.

Before you begin

Before you get started, review the following sections.

Create or select a project

To make it easier to configure Network Connectivity Center, start by identifying a valid project.

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Go to project selector

Make sure that billing is enabled for your Google Cloud project.

Install the Google Cloud CLI.

To initialize the gcloud CLI, run the following command:

gcloud init

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Go to project selector

Make sure that billing is enabled for your Google Cloud project.

Install the Google Cloud CLI.

To initialize the gcloud CLI, run the following command:

gcloud init

If you are using the Google Cloud CLI, set your project ID by using the gcloud config set command.
```
gcloud config set project PROJECT_ID
```
Replace PROJECT_ID with your unique project ID.

The gcloud CLI instructions on this page assume that you have set your project ID.
To confirm that you set the project ID correctly, use the gcloud config list command.
```
gcloud config list --format='text(core.project)'
```

Enable the Network Connectivity API

Before you can perform any tasks using Network Connectivity Center, you must enable the Network Connectivity API.

Console

To enable the Network Connectivity API:

In the Google Cloud console, go to the Network Connectivity Center page.

Go to Network Connectivity Center
Click Enable.

Alternatively, you can enable the API by using the Google Cloud console API Library, as described in Enabling APIs.

Permissions required for this task

To perform this task, you must have been granted the following permissions or the following IAM roles.

Permissions

compute.networks.use on the VPC network being added to a spoke
networkconnectivity.groups.use on the hub that the spoke is being associated with
networkconnectivity.spokes.create in the project where the VPC network lives

Roles

roles/compute.networkAdmin on the VPC network being added to a spoke
roles/networkconnectivity.groupUser on the hub that the spoke is being associated with
roles/networkconnectivity.spokeAdmin in the project where the VPC network lives

Propose a spoke

To create a VPC spoke in the same project as the hub or in a different project, follow these steps.

If you want to assign exclude export ranges or include export ranges, use the appropriate options during spoke creation.

Console

In the Google Cloud console, go to the Network Connectivity Center page.

Go to Network Connectivity Center
In the project menu, select a project in which you want to create the spoke.
Click the Spokes tab.
Click Add spokes.
In the Select hub section, to attach the new spoke to a hub in another project, select the hub location as In another project.
Enter the Project ID and the Hub name to which you want to attach your new spoke.
Enter a Spoke name and optionally, a Description.
If the hub that you are connecting to is configured for star topology, select or enter the Spoke group name for your spoke. For information about star topology, see Star topology. For information about spoke groups, see Spoke groups.
For Spoke type, the following options are available:
- For a hub in a different project, the default Spoke type is VPC spoke.
- For a hub in the same project, allowed spoke types are determined by pre-existing spoke types.
- If there are no spokes, you can select any spoke type, although the preselected option is Cloud VPN tunnel.
To add a VPC network to the spoke, select the VPC network from the list.
Optionally, you can add a VPC spoke filter to customize how routes are advertised by entering an IP address range to exclude or include export from the spoke to hub. You cannot change this filter after the spoke is created.
Click Done.
If you want to add more spokes, click Add spoke and begin the process again, starting with entering a Spoke name.
When you have finished adding spokes, click Create. The Network Connectivity Center page updates to show details about the spokes that you created.

The spoke status remains Inactive until the hub administrator reviews and accepts your proposed spoke.

gcloud

To create a VPC spoke, use the gcloud network-connectivity spokes linked-vpc-network create command.

gcloud network-connectivity spokes linked-vpc-network create SPOKE_NAME \
    --hub=HUB_URI \
    --global \
    --vpc-network=VPC_NETWORK \
    --exclude-export-ranges=[EXCLUDE_CIDR_RANGE] \
    --include-export-ranges=[INCLUDE_CIDR_RANGE] \
    --group=GROUP_NAME

Replace the following:

SPOKE_NAME: a name for the spoke that you are creating.
HUB_URI: the URI of a hub in a different project that you want to create the spoke in.
VPC_NETWORK: the VPC network that this spoke provides connectivity to. The VPC network must be in the same project as the spoke.
[EXCLUDE_CIDR_RANGE]: a comma-separated list of IP address ranges to be excluded from exporting to the hub (up to 16 CIDR ranges), such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32. The specified ranges must be longer than or equal to the individually configured subnets within the VPC.
[INCLUDE_CIDR_RANGE]: a comma-separated list of IP address ranges to be included in exporting to the hub (up to 16 CIDR ranges), such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32.
GROUP_NAME: the group this spoke belongs to. The supported values are default for a mesh topology hub or center or edge for a star topology hub. This field is required for spoke groups that use star topology. For detailed information about spoke groups, see Spoke groups.

API

To create a VPC spoke, use the networkconnectivity.spokes.create method.

  POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/spokes
  {
    "name":"NAME",
    "hub":"HUB_URI",
    "linkedVpcNetwork": {
       "uri": VPC_URI,
       "include_export_ranges": "[INCLUDE_CIDR_RANGE]",
       "exclude_export_ranges": "[EXCLUDE_CIDR_RANGE]",
       "group": "GROUP_NAME"
    },
  }

Replace the following values:

PROJECT_ID: the project ID of the project that contains the new spoke.
HUB_URI: the full hub URI including the project, since the hub is in a different project from the spoke—for example, projects/hub-project-ID/locations/global/hubs/hub-name.
VPC_URI: The VPC network that this spoke points to, such as vpc_uri.
[INCLUDE_CIDR_RANGE]: a comma-separated list of IP address ranges to be included in exporting to the hub (up to 16 CIDR ranges), such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32. The specified ranges must be longer than or equal to the individually configured subnets within the VPC.
[EXCLUDE_CIDR_RANGE]: a comma-separated list of IP address ranges to be excluded from exporting to the hub (up to 16 CIDR ranges), such as 10.1.0.0/16, 192.168.0.0/24, 172.16.1.1/32.
GROUP_NAME: the group that this spoke belongs to—for example, center or edge. This field is required for spoke groups that use star topology. For detailed information about spoke groups, see Spoke groups.

What's next

To create hubs and spokes, see Work with hubs and spokes.
To view a list of partners whose solutions are integrated with Network Connectivity Center, see Network Connectivity Center partners.
To find solutions to common issues, see Troubleshooting.
To get details about API and gcloud commands, see APIs and reference.