Question

A financial analytics company is deploying microservices across three GCP regions (us-central1, europe-west1, and asia-southeast1). Each region runs independent GKE clusters that must communicate over private IP with low administrative overhead. The security team mandates centralized IAM control over subnets and firewall rules, and requires that developers in separate projects cannot alter network configuration but can deploy workloads into pre-provisioned subnets. Which network design best meets these requirements?

Accepted Answer

Use a Shared VPC hosted in a host project with subnets in all three regions, and grant service projects the Network User role on specific subnets while retaining admin control in the host project.

Answer

Create a separate VPC in each service project and connect them using VPC Network Peering in a full mesh, delegating firewall management to each project team.

Answer

Deploy a single VPC in one region and use Cloud VPN tunnels between regions, granting each service project full Network Admin on the shared VPC.

Answer

Create independent VPCs per region and interconnect them with Cloud Interconnect, using organization policies to restrict firewall changes.