Networking in Confluent Cloud for GCP

Follow this procedure to configure Confluent Cloud network peering for a cluster in GCP.

Prerequisite
A Dedicated Kafka cluster in GCP with VPC Peering enabled. The cluster must be provisioned in its own network and provide a CIDR for Confluent Cloud. For more information about how to create a dedicated cluster, see Create a Cluster in Confluent Cloud.
  1. Navigate to the Cluster Settings page, click the Networking tab, and click Add Peering.

  2. Provide the GCP Project ID, GCP Network Name, optionally select Import Custom Routes for your peering connection, and click Save. Your peering connection status will transition from “Pending” to “Inactive” in the Confluent Cloud web UI.

    GCP Project ID

    This is a unique identifier for your project. To find the unique identifier for your project, see the Google Cloud Platform dashboard.

    GCP Network Name

    Specify the network name of the peer VPC. To find the network name, navigate to GCP Networking and see VPC Networks.

    Import Custom Routes (In Preview. See preview note)

    This is an optional parameter. Enable this option to import static and dynamic custom routes over the VPC peering connection. The custom routes have to be configured to be exported in the customer VPC.

  3. When the connection status is “Inactive” in the Confluent Cloud web UI, navigate to the GCP Networking select VPC network peering. Click CREATE CONNECTION to create a peering connection the Confluent Cloud.

  4. In the Google Cloud Platform dashboard, fill out the form to initiate a peering connection to Confluent Cloud and click CREATE.

    Name

    Specify a name for your peering connection.

    Your VPC network

    Specify the name of your GCP VPC network.

    Peered VPC network

    Select In another project.

    Project ID

    Specify your Confluent Cloud Project ID. You can find this in the Confluent Cloud Networking tab for your cluster.

    VPC network name

    Specify your Confluent Cloud VPC Name. You can find this in the Confluent Cloud Networking tab for your cluster.

  5. When you are done the VPC peering status should display “Active” in the Confluent Cloud web UI.

Import Custom Routes (Preview)

Note

Preview Note

  1. GCP Import Custom Routes option is currently in preview. Please contact your Confluent representative to get access to the preview.
  2. GCP Import Custom Routes preview is not covered by SLA and is not recommended for production workloads.

The Import Custom Routes option enables transitive routing in Confluent Cloud clusters to support connectivity to/from

  • Customer VPCs in the same region and
  • External networks connected through peered customer VPCs in the same region. External networks could be customer premise network and/or VPCs/VNETs in other cloud providers. The external networks have to be connected to peered customer VPCs using GCP Cloud VPN or GCP Cloud Interconnect.

Please take a note of considerations as mentioned by GCP in their VPC Peering documentation before enabling Import Custom Routes option.

Warning

Limitations

  1. Enabling or disabling the Import Custom Routes option on an existing VPC Peering connection is not supported.
    1. The Import Custom Routes option must be enabled when you set up the VPC peering connection.
    2. In order to enable Import Custom Routes option on an existing VPC peering connection, tear down the VPC peering connection and reesablish it with Import Custom Routes option enabled. Please allow 15 minutes between tearing down the VPC connection and reestablishing it.
    3. In order to disable Import Custom Routes option, tear down the VPC peering connection and reesablish it with Import Custom Routes option disabled. Please allow 15 minutes between tearing down the VPC connection and reestablishing it. As an alternative, disable export custom route option in the customer VPC.
  2. Transitive routing to customer VPCs in different region(s) is not supported. The only exception is when cross-regional customer VPCs are interconnected using Cloud VPN. However, the customer VPC, which is peered with Confluent Cloud cluster, must be in the same region as Confluent Cloud cluster.
  3. Transitive routing to external networks connected through customer VPCs that require global access to be turned on for GCP Internal Load Balancing is not supported.
  4. Direct routing to external networks from Confluent Cloud cluster is not supported.
  5. Custom Route Export support from Confluent Cloud cluster is not supported.