GCP Networking — Shared VPC vs VPC Peering

 

GCP Networking — Shared VPC vs VPC Peering

1. First, correct the mental model

There are two different goals:

Shared VPC

You want multiple projects to use one centrally managed VPC.

              Host Project
                   |
              Shared VPC
             /     |     \
            /      |      \
        Project A Project B Project C
          VM        VM        VM

Think:

One network → multiple projects

VPC Network Peering

You already have separate VPC networks and want them to communicate privately.

VPC-A  ←──── Private Peering ────→  VPC-B

Think:

Separate networks → private connection

2. Same organization vs different organizations

Different organizations

If you have:

Organization A
     |
    VPC-A

and:

Organization B
     |
    VPC-B

and you want private communication:

VPC-A ←──── Peering ────→ VPC-B

You use VPC Network Peering.

Shared VPC is designed around projects within the same organization.

3. Same project

The lesson says:

If you want private communication between VPC networks in the same project, use VPC Network Peering.

Important nuance:

A VPC is already a project-level resource, but a project can have multiple VPC networks.

For example:

Project-A
   |
   ├── VPC-1
   |
   └── VPC-2

If VPC-1 and VPC-2 need private connectivity:

VPC-1 ←──── VPC Peering ────→ VPC-2

So:

Shared VPC is for sharing a VPC across projects; Peering connects separate VPC networks.

4. The biggest difference: Administration

This is probably the most important point in this entire comparison.

Shared VPC = Centralized

                 Network Admin
                      |
                 Host Project
                      |
                  Shared VPC
                /     |      \
               /      |       \
             VM      VM       VM
          Project A Project B Project C

The network is centrally managed.

The host project/network administrators manage things such as:

  • Network
  • Subnets
  • Network policies
  • Firewall configuration
  • Network-level security

The application teams can still manage their resources in their service projects.

Remember:

Shared VPC = Central network control + separate workloads.

5. VPC Peering = Decentralized

        VPC-A                         VPC-B
      Admin A                       Admin B
         |                             |
      Firewall A                    Firewall B
      Routes A                      Routes B
         \                             /
          \                           /
           ─────── Peering ─────────

Each VPC remains independently managed.

VPC-A administrators manage VPC-A.

VPC-B administrators manage VPC-B.

So:

VPC Peering = connectivity without merging administration.

6. Very easy comparison

Shared VPCVPC Network Peering
Basic purposeShare one VPCConnect separate VPCs
Network modelCentralizedDecentralized
Host projectYesNo
Service projectsYesNo
Same organizationYesYes
Different organizations❌✅
Same projectNot the use case✅
Separate VPC networksNo — shared VPC is one VPCYes
Network administrationCentralizedSeparate
Private connectivityYesYes

One-line memory trick:

Shared VPC = Share a network.
Peering = Connect networks.

7. Advanced case: Peering with a Shared VPC

This is an important concept.

You can actually combine both technologies.

Suppose:

             Organization
                  |
              Host Project P1
                  |
             Shared VPC
             Network SVPC
              /       \
             /         \
       Service P3     Service P4
          VM1            VM4

P3 and P4 use the Shared VPC.

Now suppose another VPC exists:

Network A
   |
  VM2

You can establish:

Network A
    |
    | VPC Peering
    |
Shared VPC
Network SVPC

Now you have:

                 Shared VPC
              Network SVPC
             /      |       \
           VM1     VM2?      VM4
                    ↑
                 Network A

More accurately:

VM1 ─┐
     │
VM4 ─┼── Shared VPC ─── Peering ─── Network A ─── VM2
     │
Other VMs

The VMs connected through these networks can have private internal IP connectivity, subject to firewall rules and the applicable routing configuration.

8. Firewall rules still apply

Even if you establish peering:

VPC-A ←──── Peering ────→ VPC-B

it doesn't automatically mean:

Everything can talk to everything

Each VPC has its own firewall rules.

For example:

VPC-A Firewall
      ↓
Allow TCP 443
      ↓
VPC-B

but:

VPC-A Firewall
      ↓
Deny TCP 22
      ↓
VPC-B

So remember:

Peering provides connectivity; firewall rules control whether traffic is allowed.

9. Two Shared VPCs can also be peered

This is another advanced architecture.

Imagine:

Organization A

Host Project A
      |
 Shared VPC-A
 /          \
VM1         VM2

and:

Organization B

Host Project B
      |
 Shared VPC-B
 /          \
VM3         VM4

You can establish:

Shared VPC-A
      |
      | VPC Peering
      |
Shared VPC-B

So:

VPC Peering can connect two Shared VPC networks.

This combines:

  • Shared VPC → centralized management within each organization
  • VPC Peering → private connectivity between the separate VPC networks

🧠 Final mental picture

There are three architectures you should recognize:

① Shared VPC

             Host
              |
          ONE VPC
        /    |    \
       ↓     ↓     ↓
     P1     P2     P3

Use when: multiple projects should use one centrally managed network.

② VPC Peering

VPC-A  ←──────→  VPC-B

Use when: separate VPCs need private communication.

③ Shared VPC + Peering

Projects          Projects
   ↓                 ↓
Shared VPC-A ←──→ Shared VPC-B

Use when: each side wants centralized network management internally, but the two separate VPC environments also need private connectivity.

⭐ What to remember for your exam

SHARED VPC
↓
One VPC
↓
Multiple projects
↓
Centralized network administration
VPC PEERING
↓
Separate VPCs
↓
Private connectivity
↓
Decentralized administration
SHARED VPC + PEERING
↓
Shared VPC can be peered
↓
Two Shared VPC networks can also be peered

And the most important distinction:

Shared VPC answers: "How can multiple projects share one centrally managed network?"
VPC Peering answers: "How can separate VPC networks communicate privately?"

Comments

Post a Comment

Popular posts from this blog

Async/await

  Async/await An async function is a function declared with the async keyword, and the await keyword is permitted within them. The async and await keywords enable asynchronous, promise-based behavior to be written in a cleaner style, avoiding the need to explicitly configure promise chains. "async and await make promises easier to write" async  makes a function return a Promise await  makes a function wait for a Promise  Async functions Let’s start with the async keyword. It can be placed before a function, like this: async function f() {   return 1; } The word “async” before a function means one simple thing: a function always returns a promise. Other values are wrapped in a resolved promise automatically. For instance, this function returns a resolved promise with the result of 1; let’s test it: async function f() {   return 1; } f().then(alert); // 1 …We could explicitly return a promise, which would be the same: async function f() {   return Promis...
Read more

First negative in every window of size k

 Given an array arr[]  and a positive integer k, find the first negative integer for each and every window(contiguous subarray) of size k. Note: If a window does not contain a negative integer, then return 0 for that window. Examples: Input: arr[] = [-8, 2, 3, -6, 10] , k = 2 Output: [-8, 0, -6, -6] Explanation: Window [-8, 2] First negative integer is -8. Window [2, 3] No negative integers, output is 0. Window [3, -6] First negative integer is -6. Window [-6, 10] First negative integer is -6. Input: arr[] = [12, -1, -7, 8, -15, 30, 16, 28] , k = 3 Output: [-1, -1, -7, -15, -15, 0]  Explanation: Window [12, -1, -7] First negative integer is -1. Window [-1, -7, 8] First negative integer is -1. Window [-7, 8, -15] First negative integer is -7. Window [8, -15, 30] First negative integer is -15. Window [-15, 30, 16] First negative integer is -15. Window [30, 16, 28] No negative integers, output is 0. Input: arr[] = [12, 1, 3, 5] , k = 3 Output: [0, 0]  Explanation: Windo...
Read more

Valid Parentheses

Given a string s containing just the characters '(', ')', '{', '}', '[' and ']', determine if the input string is valid. An input string is valid if: Open brackets must be closed by the same type of brackets. Open brackets must be closed in the correct order. Every close bracket has a corresponding open bracket of the same type.   Example 1: Input: s = "()" Output: true Example 2: Input: s = "()[]{}" Output: true Example 3: Input: s = "(]" Output: false Example 4: Input: s = "([])" Output: true   Stack-Based Logic: Traverse each character in the string. If it's an opening bracket ( '(' , '{' , '[' ), push it onto the stack. If it's a closing bracket ( ')' , '}' , ']' ): If the stack is empty , return false (nothing to match). If the top of the stack is the corresponding opening bracket , pop it. Otherwise, return false . ...
Read more