Networking
Below table contains the network design for all projects. The secondary network CIDR ranges are for use by GKE clusters.
VPC Design (Reserved)
These are the list of IP ranges we will be soft-reserving for our projects. GCP VPC doesn’t have an outer CIDR range. This means you can extend the network anytime. This soft reservation is for us to manage the network blocks in all projects and not reach a situation where CIDRs collide.
Note: Workspaces in terraform cloud will have “infra” as a suffix.
| Project Name | VPC Name | VPC Type | VPC Ranges |
|---|---|---|---|
| aa-cp-npr-01 | aa-vpc-npr-cp | VPC | Main VPC CIDR: 10.200.0.0/16 GCP Services VPC: 10.201.0.0/16 |
| aa-dp-npr-01 | aa-vpc-npr-dp | VPC | Main VPC CIDR: 10.203.0.0/16 GCP Services VPC: 10.202.0.0/16 |
Subnets
Out of the soft-reserved ranges, we are using the following ranges in current projects.
| VPC Name | Subnet Details |
|---|---|
| aa-vpc-npr-cp | aa-subnet-npr-cp-apps-uc1 [10.200.0.0/16] aa-subnet-npr-cp-psc-uc1 [10.201.0.0/16] |
| aa-vpc-npr-dp | aa-subnet-npr-dp-apps-uc1 [10.203.0.0/16] aa-subnet-npr-dp-psc-uc1 [10.202.0.0/16] |
Firewall Rules
Configured below firewall rules for secure access and traffic control in current projects
| VPC Network | Firewall Name | Ports | IP Ranges |
|---|---|---|---|
| aa-vpc-npr-cp | aa-fw-prod-ssh-iap | TCP 22, 5432 | 35.235.240.0/20, 10.200.0.0/16 |
| aa-vpc-npr-cp | aa-vpc-npr-cp-allow-https | TCP 443 | 0.0.0.0/0 |
| aa-vpc-npr-cp | aa-vpc-npr-cp-allow-http | TCP 80 | 0.0.0.0/0 |
| aa-vpc-npr-cp | allow | TCP | 10.200.0.0/16 |
| aa-vpc-npr-cp | aa-fw-prod-health-check | TCP 0 | 209.85.204.0/22, 209.85.152.0/22, 130.211.0.0/22, 35.191.0.0/16 |
| aa-vpc-npr-dp | aa-fw-prod-ssh-iap | TCP 22 | 35.235.240.0/20 |
| aa-vpc-npr-dp | aa-fw-prod-health-check | TCP 0 | 209.85.204.0/22, 209.85.152.0/22, 130.211.0.0/22, 35.191.0.0/16 |
Cloud NAT
Cloud NAT to enable outbound access for private resources without external IPs
| Gateway Name | Project | Cloud Router |
|---|---|---|
| aa-nat-npr-cp-uc1 | aa-cp-npr-01 | aa-cr-npr-cp-uc1 |
| aa-nat-npr-dp-uc1 | aa-dp-npr-01 | aa-cr-npr-dp-uc1 |
Cloud Routers
| Cloud Router Name | Project | Network Name |
|---|---|---|
| aa-cr-npr-cp-uc1 | aa-cp-npr-01 | cr-vpc-dev |
| aa-cr-npr-dp-uc1 | aa-dp-npr-01 | aa-vpc-npr-dp |
IP Addresses
| IP Address Name | Range | Project | Type |
|---|---|---|---|
| aa-cp-npr-timescaledb-vm-static-pvt-ip | 10.200.0.6 | aa-cp-npr-01 | Internal |
| serverless-ipv4-1752484363715233510 | 10.200.0.16/28 | aa-cp-npr-01 | Internal |
| serverless-ipv4-1753204058854218416 | 10.200.0.64/28 | aa-cp-npr-01 | Internal |
| serverless-ipv4-1753700397329575912 | 10.200.0.48/28 | aa-cp-npr-01 | Internal |
| VM instance aa-vm-cp-npr-bastion-uc1 | 10.200.0.4 | aa-cp-npr-01 | Internal |
| Forwarding rule spicedb-ilb-forwarding-rule | 10.200.0.36 | aa-cp-npr-01 | Internal |
| nat-auto-ip-3060894-7-1752261840272452 | 34.55.120.109 | External | |
| nat-auto-ip-28178154-5-1752566793544452 | 35.232.159.245 | aa-dp-npr-01 | External |
| VM instance aa-vm-dp-npr-bastion-uc1 | 10.203.0.2 | aa-dp-npr-01 | Internal |
Private Service Access
| Private Service Access | Project | PSC Range | Network Name |
|---|---|---|---|
| aa-subnet-npr-cp-psc-uc1 | aa-cp-npr-01 | 10.201.0.0/16 | aa-vpc-npr-cp |
| aa-subnet-npr-dp-psc-uc1 | aa-dp-npr-01 | 10.202.0.0/16 | aa-vpc-npr-dp |
Load Balancer
| Load Balancer Name | Project | Load Balancer Type | IP Address |
|---|---|---|---|
| arthur-url-map | aa-cp-npr-01 | External | 34.36.203.190 |
| auth-redirect | aa-cp-npr-01 | External | 34.36.203.190 |
| spicedb-ilb-url-map | aa-cp-npr-01 | Internal | 10.200.0.36 |
| aa-dp-npr-lb | aa-dp-npr-01 | External | 34.144.222.153 |
| aa-dp-npr-lb-fe-redirect | aa-dp-npr-01 | External | 34.144.222.153 |
Updated 13 days ago