Networking

Below table contains the network design for all projects. The secondary network CIDR ranges are for use by GKE clusters.

VPC Design (Reserved)

These are the list of IP ranges we will be soft-reserving for our projects. GCP VPC doesn’t have an outer CIDR range. This means you can extend the network anytime. This soft reservation is for us to manage the network blocks in all projects and not reach a situation where CIDRs collide.

Note: Workspaces in terraform cloud will have “infra” as a suffix.

Project Name	VPC Name	VPC Type	VPC Ranges
aa-cp-npr-01	aa-vpc-npr-cp	VPC	Main VPC CIDR: 10.200.0.0/16 GCP Services VPC: 10.201.0.0/16
aa-dp-npr-01	aa-vpc-npr-dp	VPC	Main VPC CIDR: 10.203.0.0/16 GCP Services VPC: 10.202.0.0/16

Subnets

Out of the soft-reserved ranges, we are using the following ranges in current projects.

VPC Name	Subnet Details
aa-vpc-npr-cp	aa-subnet-npr-cp-apps-uc1 [10.200.0.0/16] aa-subnet-npr-cp-psc-uc1 [10.201.0.0/16]
aa-vpc-npr-dp	aa-subnet-npr-dp-apps-uc1 [10.203.0.0/16] aa-subnet-npr-dp-psc-uc1 [10.202.0.0/16]

Firewall Rules

Configured below firewall rules for secure access and traffic control in current projects

VPC Network	Firewall Name	Ports	IP Ranges
aa-vpc-npr-cp	aa-fw-prod-ssh-iap	TCP 22, 5432	35.235.240.0/20, 10.200.0.0/16
aa-vpc-npr-cp	aa-vpc-npr-cp-allow-https	TCP 443	0.0.0.0/0
aa-vpc-npr-cp	aa-vpc-npr-cp-allow-http	TCP 80	0.0.0.0/0
aa-vpc-npr-cp	allow	TCP	10.200.0.0/16
aa-vpc-npr-cp	aa-fw-prod-health-check	TCP 0	209.85.204.0/22, 209.85.152.0/22, 130.211.0.0/22, 35.191.0.0/16
aa-vpc-npr-dp	aa-fw-prod-ssh-iap	TCP 22	35.235.240.0/20
aa-vpc-npr-dp	aa-fw-prod-health-check	TCP 0	209.85.204.0/22, 209.85.152.0/22, 130.211.0.0/22, 35.191.0.0/16

Cloud NAT

Cloud NAT to enable outbound access for private resources without external IPs

Gateway Name	Project	Region	Cloud Router
aa-nat-npr-cp-uc1	aa-cp-npr-01	us-central1	aa-cr-npr-cp-uc1
aa-nat-npr-dp-uc1	aa-dp-npr-01	us-central1	aa-cr-npr-dp-uc1

Cloud Routers

Cloud Router Name	Project	Region	Network Name
aa-cr-npr-cp-uc1	aa-cp-npr-01	us-central1	cr-vpc-dev
aa-cr-npr-dp-uc1	aa-dp-npr-01	us-central1	aa-vpc-npr-dp

IP Addresses

IP Address Name	Range	Project	Region	Type
aa-cp-npr-timescaledb-vm-static-pvt-ip	10.200.0.6	aa-cp-npr-01	us-central1	Internal
serverless-ipv4-1752484363715233510	10.200.0.16/28	aa-cp-npr-01	us-cental1	Internal
serverless-ipv4-1753204058854218416	10.200.0.64/28	aa-cp-npr-01	us-cental1	Internal
serverless-ipv4-1753700397329575912	10.200.0.48/28	aa-cp-npr-01	us-cental1	Internal
VM instance aa-vm-cp-npr-bastion-uc1	10.200.0.4	aa-cp-npr-01	us-central1	Internal
Forwarding rule spicedb-ilb-forwarding-rule	10.200.0.36	aa-cp-npr-01	us-central1	Internal
nat-auto-ip-3060894-7-1752261840272452	34.55.120.109		us-central1	External
nat-auto-ip-28178154-5-1752566793544452	35.232.159.245	aa-dp-npr-01	us-central1	External
VM instance aa-vm-dp-npr-bastion-uc1	10.203.0.2	aa-dp-npr-01	us-central1	Internal

Private Service Access

Private Service Access	Project	Region	PSC Range	Network Name
aa-subnet-npr-cp-psc-uc1	aa-cp-npr-01	us-central1	10.201.0.0/16	aa-vpc-npr-cp
aa-subnet-npr-dp-psc-uc1	aa-dp-npr-01	us-east4	10.202.0.0/16	aa-vpc-npr-dp

Load Balancer

Load Balancer Name	Project	Region	Load Balancer Type	IP Address
arthur-url-map	aa-cp-npr-01	us-central1	External	34.36.203.190
auth-redirect	aa-cp-npr-01	us-central1	External	34.36.203.190
spicedb-ilb-url-map	aa-cp-npr-01	us-central1	Internal	10.200.0.36
aa-dp-npr-lb	aa-dp-npr-01	us-central1	External	34.144.222.153
aa-dp-npr-lb-fe-redirect	aa-dp-npr-01	us-central1	External	34.144.222.153