Use VPC Peering on Google Cloud

A VPC peering connection is a networking connection between your VPC and Confluent Cloud that enables you to route traffic using private IPv4 addresses. VPCs can communicate with each other as if they are within the same network.

For more information about VPC peering with Google Cloud, see VPC Network Peering.

Prerequisites

  • A Confluent Cloud network of type PEERING in Google Cloud. If a network does not exist, follow the procedure below.

Important

Cross-region access to Confluent Cloud is not supported when VPC peering is enabled with Google Cloud. Your VPC subnets and Confluent Cloud must be in the same same region.

Create a Confluent Cloud network in in Google Cloud

To create a Dedicated cluster with Google Cloud VPC Peering, you must first create a Confluent Cloud network in the required cloud and region.

Note

You can create multiple clusters within one Confluent Cloud network. For details on default service quotas, see Network quotas.

Review the following requirements for CIDR block (or IP address range) selections.

The CIDR block must be in one of the following private networks:

  • 10.0.0.0/8
  • 100.64.0.0/10
  • 172.16.0.0/12
  • 192.168.0.0/16

The CIDR block cannot be any of the following:

  • 172.17.0.0/16

Additional notes when selecting your CIDR block:

  • The RFC 6598 shared address space is supported on Google Cloud.
  • Must be a /16 CIDR block.
  • Cannot be modified after the Confluent Cloud network is provisioned.
  • Cannot overlap with an existing Confluent Cloud CIDR block.
  • Contact Confluent Support to add a new cluster in an existing /16 CIDR block.
  1. In the Confluent Cloud Console, go to the Network management page for your environment.
  2. Click Create your first network if this is the first network in your environment, or click + Add Network if your environment has existing networks.
  3. Select Google Cloud as the cloud service provider and the desired geographic region.
  4. Select the Peering connectivity type and enter your the Zone Placement and CIDR for Confluent Cloud. Click Continue.
  5. Specify a Network Name, review your configuration, and click Create Network.

In most cases, it takes up to 15 to 20 minutes to create a Confluent Cloud network. Keep note of the Confluent Cloud network ID from the response as you need to specify it in commands in the next section.

After successfully provisioning the Confluent Cloud network, you can add Dedicated clusters within your Confluent Cloud network by using either of the following procedures:

Create a VPC peering connection

Follow this procedure to create a VPC network peering connection to a Confluent Cloud cluster on Google Cloud using the Confluent Cloud Console or REST APIs.

The following information is required:

  • The Google Cloud project ID associated with the VPC that you are peering to Confluent Cloud.
  • The network name of the VPC that you are peering with Confluent Cloud.
  • The CIDR block of the VPC you are peering with Confluent Cloud. This is used by Confluent Cloud to route traffic back to your network.
  • You might need to increase your route quota when you use VPC peering because the Confluent Cloud and Google Cloud routes are shared.
  1. In the Confluent Cloud Console, go to your desired Confluent Cloud network resource and click + VPC Peering.

  2. Enter Name, GCP Project ID and GCP Network Name. You can also choose to Import custom routes.

  3. Click Add to create the peering connection. Peering connection provisioning will take a few minutes to complete. Your peering connection status will transition from “Provisioning” to “Inactive” in the Confluent Cloud Console.

  4. Go to VPC network in the Google Cloud Console select VPC network peering. Click CREATE CONNECTION to create a peering connection the Confluent Cloud.

  5. Complete the form to initiate a peering connection to Confluent Cloud and click CREATE.

    Name

    Specify a name for your peering connection.

    Your VPC network

    Specify the name of your Google Cloud VPC network.

    Peered VPC network

    Select In another project.

    Project ID

    Specify your Confluent Cloud Project ID. You can find this in the Confluent Cloud Console Networking tab for your cluster.

    VPC network name

    Specify your Confluent Cloud VPC name. You can find this in the Confluent Cloud Console Networking tab for your cluster.

Verify that the Status under VPC Peering connections is “Active”.

Import Custom Routes

The Import Custom Routes option enables connectivity to a Confluent Cloud cluster in Google Cloud from customer premise or other clouds, such as AWS and Azure, through a customer VPC that is peered with Confluent Cloud in the same region. This connectivity is enabled by importing static and dynamic custom routes from a customer VPC into a Confluent Cloud VPC over the VPC peering connection. The customer side VPC peering has to be configured to export custom routes.

Review the considerations mentioned by Google Cloud in their VPC Peering documentation before enabling Import Custom Routes option.

Important

Limitations for Import Custom Routes

  1. Enabling or disabling the Import Custom Routes option on an existing VPC Peering connection is not supported.
    1. The Import Custom Routes option must be enabled when you set up the VPC peering connection.
    2. In order to enable Import Custom Routes option on an existing VPC peering connection, tear down the VPC peering connection and reestablish it with the Import Custom Routes option enabled. Allow 15 minutes between tearing down the VPC connection and reestablishing it to avoid getting an error message during recreation.
    3. In order to disable the Import Custom Routes option, tear down the VPC peering connection and reestablish it with the Import Custom Routes option disabled. Allow 15 minutes between tearing down the VPC connection and reestablishing it to avoid getting an error message during recreation. As an alternative, disable the Export Custom Route option in the customer VPC.
  2. Transitive routing to your VPCs in same or different regions is not supported. The only exception is when cross-regional VPCs are interconnected using Google Cloud VPN. However, your VPC, which is peered with Confluent Cloud cluster, must be in the same region as Confluent Cloud cluster.
  3. Transitive routing to external networks connected through customer VPCs that require global access to be turned on for Google Cloud Internal Load Balancing is not supported.
  4. Export Custom Routes support from Confluent Cloud cluster is not supported.
  5. Privately used public IP (PUPI) addresses are not supported with Import Custom Routes