Investigate NCC Network Connectivity Center as hub/spoke VPC sharing option beyond VPC Peering

[fmichaelobrien]

Updates

• Aug 29 2023 - Next 23 - https://cloud.google.com/blog/products/networking/whats-new-with-google-cloud-networking
• help with PSC Ground to Cloud where PaaS services behind the hub VPC have hidden VPCs containing Google Managed VM's with transitive sharing issues (more than 2 hops) - not directly related to the 25 limit on peering
• Ground to Cloud enablement through PSC (private service connect) or PGA (private google access) through an interconnect or VPN for private GCP API access - customer procedure using AWS as simulated groud #494

Work Items

• research NCC as a transit hub for VPC sharing for perimeter access specific to profile 5 and 6 but with 2-4 in mind
• https://cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/overview
• https://cloud.google.com/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes

References

• see serverless P3 poc in Use Case: POC Serverless Canary Application (frontend/backend/persistence) as a Profile 3 LZ workload with PSC, PSA and VPC-SC #418
• See earlier V1 architecture discussions https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/dev/solutions/landing-zone/architecture.md
• See V2 architecture diagrams at https://docs.google.com/presentation/d/1Ztqn7G2rWFlssVwC7r5Xl-WFSFCbVo6MoHJffrXScmw/edit#slide=id.g25262d569c1_0_198
• See GCP network-patterns share at https://docs.google.com/presentation/d/13sjT2tJ4yLIYGRREE3wBrylB1OvcEMpKdquVuJB_nX4/edit?resourcekey=0-N3DruQaiutFvZ98HTT7-vQ#slide=id.g1154b3b950f_2_3458
• see Guardrails V1 https://github.com/canada-ca/cloud-guardrails/blob/master/EN/00_Applicable-Scope.md#applicability-of-guardrails-to-cloud-usage-profiles
• see Guardrails V2 https://github.com/CloudLandingZone/cloud-guardrails-v2

[cartyc]

Haven't dropped too into this one yet. @fmichaelobrien would these be the corresponding KCC objects?

• NetworkConnectivityHub
• NetworkConnectivitySpoke

[obriensystems]

Additional transit peering instructions related to VPCs peered with the interconnect enabled VPC (perimeter)
https://cloud.google.com/vpc/docs/vpc-peering#transit-network from https://cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/overview#vpc-peering