Question

A large enterprise runs a central networking team that must own all VPC networks, subnets, and firewall rules. Twelve application teams each operate in their own Google Cloud project and deploy Compute Engine and GKE workloads that all need private connectivity to a common on-premises data center over existing HA VPN tunnels. The networking team wants to avoid managing peering meshes and wants to centrally control routing and firewalls while letting app teams retain autonomy over their own resources and IAM. Which design best meets these requirements?

Accepted Answer

Create a Shared VPC host project owned by the networking team, define the subnets and firewall rules there, and attach the twelve application projects as service projects.

Answer

Create a standalone VPC in each application project and connect them all using a full mesh of VPC Network Peering to a hub project that holds the HA VPN tunnels.

Answer

Create one VPC in each application project and use Network Connectivity Center with each VPC as a spoke, delegating firewall management to each app team.

Answer

Deploy a single VPC in one application project and grant the other eleven teams Owner on that project so they can share the subnets and on-prem connectivity.