<a id="create-ccloud-network-gcp"></a>

# Create Confluent Cloud Network on Google Cloud

Each Confluent Cloud network is a virtual network that is provisioned in your Confluent Cloud
Google Cloud account.

You can create multiple Dedicated Kafka clusters within each [Confluent
Cloud network](../overview.md#ccloud-network-overview).

For details on default service quotas, see [Network service quotas](../../quotas/service-quotas.md#ccloud-resource-limits-network).

## Requirements and considerations

Review the following requirements and considerations when you set up a
Confluent Cloud network.

### Region and Availability Zones

Dedicated clusters you create in your Confluent Cloud network inherit the selected
Region and Availability Zones.

<a id="cidr-block-gcp"></a>

### Confluent Cloud network CIDR blocks for VCP peering

When you set up a Confluent Cloud network for peering, the CIDR blocks you specify must meet the
follow requirements.

* The Confluent Cloud network CIDR block must be a `/16` block from one of the following private
  IP ranges:
  * [Private IP address range (RFC 1918)](https://datatracker.ietf.org/doc/html/rfc1918): `10.0.0.0/8`,
    `172.16.0.0/12`, `192.168.0.0/16`
  * [Shared address space (Carrier-grade NAT) (RFC 6598)](https://datatracker.ietf.org/doc/html/rfc6598): `100.64.0.0/10`
  * [Benchmark address space (RFC 2544)](https://datatracker.ietf.org/doc/html/rfc2544): `198.18.0.0/15`
* The CIDR block cannot be the following: `172.17.0.0/16`

  You cannot use the above CIDR for peering due to routing conflicts with
  Confluent services. For example, managed connectors cannot reach the sources
  or sinks in those IP ranges.

<a id="ccn-config-gcp"></a>

## Create a Confluent Cloud network on Google Cloud

Follow the procedure below to create a [Confluent Cloud network](../overview.md#ccloud-network-overview) on Google Cloud.

### Confluent Cloud Console

1. In the Confluent Cloud Console, select an environment for the Confluent Cloud
   network.
2. In the **Network management** tab in the environment, click
   **For dedicated clusters**.
3. Click **Add network configuration**.
4. Select **Google Cloud** as the **Cloud Provider** as the cloud service
   provider and select the geographic region in **Region**. Click
   **Continue**.
5. Select the connectivity type: **VPC Peering** or **Private Service Connect**.

   Depending on the option selected, different **Zone Placement** options and
   **CIDR for Confluent Cloud Network** fields will appear.
   * **VPC Peering**: Cluster is accessible using the VPC peering endpoint.
   * **Private Service Connect**: Cluster is accessible using Private Service Connect.
6. Complete the steps for the connectivity type you selected.

   #### IMPORTANT
   After provisioning your new Confluent Cloud network, you cannot change your
   selected Availability Zone (AZ) IDs or CIDR block size.

   ### VPC Peering

   1. Under **Zone Placement**, select three availability zones for
      your network.
   2. Click **Continue**.

   ### Private Service Connect

   1. Under **Zone Placement**, select three zones for your network.

      Depending on the availability of supported zones, you might
      only have three zones to select.
   2. Under **DNS configuration**, select the DNS resolution method.

      Select **Private DNS Resolution** to resolve the private DNS
      name of the Confluent Cloud cluster to the private IP address of the
      cluster.

      If **Private DNS Resolution** is not selected, the private DNS
      name of the Confluent Cloud cluster requires public DNS Resolution to
      resolve the private IP address of the cluster.

      Before you select a DNS resolution option, review the details
      about DNS resolution in Google Cloud Private Service Connect in
      [DNS resolution options](../private-links/gcp-private-service-connect.md#dns-resolution-options-gcp).
   3. Click **Continue**.
7. In **Network name**, specify the name of the connection.

   The name you choose is used to identify your network in the
   Confluent Cloud Console and when using the Confluent CLI. Choose a
   meaningful name, but consider including the connection type in the name
   (for example, `My-GCP-CCN-1`).

### Confluent REST API

Here is an example REST API request:

**HTTP POST request**

```text
POST https://api.confluent.cloud/networking/v1/networks
```

**Authentication**

See [Authentication](https://docs.confluent.io/cloud/current/api.html/#authentication).

**Request specification**

Your REST request specification (`spec`) should include the following:

- `display_name` (optional) A meaningful name for your Confluent Cloud network.
- `environment`
  - `id` – The identifier (ID) of your Confluent Cloud environment.
- `cloud` – cloud service provider (`GCP`)
- `region` – The Region where the network is located.
- `connection_types` Use `PEERING` (for VPC Peering) or
  `PRIVATELINK` (for Private Service Connect).
- `zones` – An array listing the three selected Availability Zone IDs in
  the same Region.
- `cidr` – The CIDR block.
- `dns_config` - Set `resolution` to `PRIVATE` or
  `CHASED_PRIVATE`. The default value is `CHASED_PRIVATE`.
  - When `resolution` is `CHASED_PRIVATE`, clusters in this network
    require both public and private DNS to resolve cluster endpoints.
  - When `resolution` is `PRIVATE`, clusters in this network only
    require private DNS to resolve cluster endpoints.

  Before you select a DNS resolution option, review the details about DNS
  resolution in Google Cloud Private Service Connect in
  [DNS resolution options](../private-links/gcp-private-service-connect.md#dns-resolution-options-gcp).

**Examples**

### Private Service Connect

```json
{
   "spec": {
       "display_name": "GCP-PL-CCN-1",
       "cloud": "GCP",
       "region": "us-west1",
       "connection_types": [
           "PRIVATELINK"
       ],
      "zones": [
        "usw2-az1",
        "usw2-az2",
        "usw2-az3"
      ],
      "dns_config": {
          "resolution": "PRIVATE"
      },
      "environment":{
          "id":"env-abc123"
      }
  }
}
```

### Confluent CLI

Use the [confluent network create](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html)
Confluent CLI command to create a Confluent Cloud network:

```bash
confluent network create <network-name> <flags>
```

The following command-specific flags are supported:

- `--cloud`: Required. Set to `gcp`.
- `--region`: Required. Cloud region ID for this network.
- `--connection-types`: Required. The network access type. Specify one of
  `privatelink`, `peering`, or `transitgateway`.
- `--cidr`: A /16 IPv4 CIDR block. Required for networks of connection
  type `peering` and `transitgateway`.
- `--zones`: A comma-separated list of availability zones for this
  network.
- `--zone-info`: A comma-separated list of `zone=cidr` pairs or CIDR
  blocks. Each CIDR must be a /27 IPv4 CIDR block.
- `--dns-resolution`: Specify the DNS resolution as `private` or
  `chased-private`. The default value is `chased-private`.
  - When `resolution` is `chased-private`, clusters in this network
    require both public and private DNS to resolve cluster endpoints.
  - When `resolution` is `private`, clusters in this network only
    require private DNS to resolve cluster endpoints.

  Before you select a DNS resolution option, review the details about DNS
  resolution in Azure PrivateLink in [DNS resolution options](../private-links/aws-privatelink.md#dns-resolution-options).

You can specify additional optional CLI flags described in the [Confluent
CLI command reference](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html),
such as `--environment`.

The following are example Confluent CLI commands:

### VPC Peering

```bash
confluent network create my_gcp_peering --cloud gcp \
  --region us-central1 \
  --connection-types peering \
  --zones us-central1-a,us-central1-b,us-central1-c \
  --cidr 10.1.0.0/16
```

### Private Service Connect

```bash
confluent network create my_gcp_pl --cloud gcp \
  --region us-central1 \
  --connection-types privatelink \
  --zones us-central1-a,us-central1-b,us-central1-c \
  --dns-resolution private
```

### Terraform

Use the [confluent_network](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_network)
Confluent Terraform Provider resource to create a Confluent Cloud network.

An example snippet of Terraform configuration for Confluent Cloud network of the Private
Service Connect type:

```terraform
resource "confluent_environment" "development" {
  display_name = "Development"

  lifecycle {
    prevent_destroy = true
  }
}

resource "confluent_network" "gcp-private-service-connect" {
  display_name     = "GCP Private Service Connect Network"
  cloud            = "GCP"
  region           = "us-central1"
  connection_types = ["PRIVATELINK"]
  zones            = ["us-central1-a", "us-central1-b", "us-central1-c"]
  environment {
    id = confluent_environment.development.id
  }

  dns_config {
    resolution = "PRIVATE"
  }

  lifecycle {
    prevent_destroy = true
  }
}
```

<br/>

Typically, it takes up to 15-20 minutes to create a Confluent Cloud network.
Note the Confluent Cloud network ID from the response to specify it in the
following commands.

## Next steps

After successfully provisioning the Confluent Cloud network on Google Cloud, you can add Dedicated
Kafka clusters within your Confluent Cloud network by using the following options:

* Confluent Cloud Console: [Create a Kafka Cluster](../../clusters/create-cluster.md#cloud-create-cluster)
* Cluster Management API: [Cluster API reference](https://docs.confluent.io/cloud/current/ccloud/clusters-cmk-v-2/)

## Related content

* VPC Peering
  * [Google Cloud VPC Peering with Confluent Cloud](../peering/gcp-peering.md#cloud-networking-gcp)
  * [VPC Network Peering on Google Cloud](https://cloud.google.com/vpc/docs/vpc-peering).
* Private Service Connect
  * [Google Cloud Private Service Connect with Confluent Cloud](../private-links/gcp-private-service-connect.md#private-service-connect-gc)
  * [Private Service Connect on Google Cloud](https://cloud.google.com/vpc/docs/private-service-connect).