From gcp
Provision and sync GCP networking resources — Network Connectivity Center hubs and spokes, Shared VPC host projects and service projects, subnets, firewall rules, and Cloud DNS private zones — from a networking-design.md and naming-convention.md. Uses the GCP MCP server. Use when applying or updating GCP networking after running design-networking.
How this skill is triggered — by the user, by Claude, or both
Slash command
/gcp:manage-gcp-networkingThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Implementation
Implementation
compute.networks.create, compute.subnetworks.createcompute.firewalls.create, compute.routes.createnetworkconnectivity.hubs.create, networkconnectivity.spokes.createcompute.organizations.enableXpnResource (for Shared VPC)dns.managedZones.create, dns.resourceRecordSets.createmanage-gcp-landing-zone).Apply the networking definition from networking-design.md to GCP. Ensure that:
(Sector, Tier, Region) with correct CIDRs.This skill is idempotent.
When writing configurations or documentation, you MUST strictly adhere to the structural notation and types defined in the book. Before proceeding, read the following reference files:
references/notation.mdreferences/types.mdnetworking-design.md. Read it first.naming-convention.md.landing-zone-design.md).Read all input documents before proceeding.
Shared VPC approach (recommended):
In the connectivity project:
compute.organizations.enableXpnResource.Subnets are created in the host VPC and shared to service projects — spoke workloads run in service projects but use subnets from the host project's network.
NCC approach:
In the connectivity project:
For each (Sector, Tier, Region) combination, create the required subnets in the hub VPC (Shared VPC) or in each spoke VPC (NCC):
| Subnet | CIDR Offset | Purpose | Private Google Access |
|---|---|---|---|
subnet-public-* | .0.0/24 | Load balancers, NAT | No |
subnet-private-* | .1.0/22 | GKE nodes, compute | Yes |
subnet-data-* | .5.0/24 | Cloud SQL, Memorystore | Yes |
subnet-proxy-* | .6.0/26 | Internal load balancers (proxy-only subnet) | N/A |
GKE secondary ranges: GKE clusters require secondary IP ranges on the node subnet for Pod CIDRs and Service CIDRs. Define these in the networking design and add them as secondary ranges on the private subnet:
/17 (or larger) per cluster/20 per clusterEnable Private Google Access on all private and data subnets so workloads can reach Google APIs without a public IP.
Shared VPC subnet sharing: For each subnet, specify which service projects are allowed to use it. Only the projects corresponding to the subnet's coordinate should have access.
GCP firewall rules are attached to the VPC network (not subnets). Create rules from the security baseline:
Baseline rules (applied to all spokes):
deny-all-ingress (priority 65534): Deny all ingress. This is the implicit default in GCP, but making it explicit with a named rule makes auditing clearer.allow-internal-ingress (priority 1000): Allow ingress from the VPC's own CIDR (intra-spoke communication). Apply only to private and data subnets via target tags.allow-hub-management (priority 900): Allow ingress from the hub/platform management CIDR on management ports (SSH, metrics scraping, health checks). Apply via target tags.allow-lb-health-checks (priority 800): Allow ingress from Google's health check IP ranges (35.191.0.0/16, 130.211.0.0/22) on health check ports.Tier("live") additional rules:
allow-public-ingress — external traffic must enter through a load balancer, not directly to VMs.Tier("sandbox"):
allow-iap-ssh, allowing 35.235.240.0/20 on port 22) — use Identity-Aware Proxy instead of public SSH.For each rule:
Centralized: Deploy Cloud NAT in the connectivity project, attached to the hub VPC's router. Route all egress traffic from spoke subnets through the hub's Cloud NAT via NCC routing.
Decentralized: Deploy Cloud NAT in each spoke project (for Shared VPC: in the service project's region, attached to the host VPC's Cloud Router for that region). Configure each subnet to use manual IP allocation for auditable egress IPs.
For each spoke (Sector, Tier, Region):
eu01.live.internal.ecommerce.mountainlab.io).private and restrict it to the hub VPC (for Shared VPC) or the spoke VPC (for NCC).Produce a summary of all resources created, already existing, or skipped.
Produce a Markdown report named gcp-networking-report.md:
# GCP Networking Sync Report
**Date**: [timestamp]
**Mode**: [applied / dry-run]
**Model**: [Shared VPC / NCC]
## Hub Network
| Resource | Project | Status |
|---------|---------|--------|
| VPC: hub-network | connectivity | created |
| Shared VPC host enabled | connectivity | applied |
## Service Project Attachments
| Service Project | Status |
|----------------|--------|
| ecommerce-live | attached |
| ecommerce-sandbox | attached |
## Subnets
| Name | VPC | CIDR | Region | Status |
|------|-----|------|--------|--------|
| subnet-private-ecommerce-live-eu01 | hub-network | 10.32.1.0/22 | europe-west1 | created |
## Firewall Rules
| Name | Network | Direction | Source | Ports | Status |
|------|---------|-----------|--------|-------|--------|
| allow-hub-management | hub-network | Ingress | 10.0.0.0/24 | 22, 9100 | created |
## Cloud DNS Private Zones
| Zone | Visibility | VPCs Authorized | Status |
|------|-----------|----------------|--------|
| eu01.live.internal.ecommerce.mountainlab.io | Private | hub-network | created |
## Direct VPC Peerings Between Spokes Found
[List any found — should be empty]
## Open Items
[GKE secondary range sizing, Shared VPC subnet sharing confirmations, etc.]
This skill is grounded in Chapter 6: Infrastructure of Crafting Platforms.
npx claudepluginhub craftingplatforms/ai --plugin gcpDesign and review GCP network architecture: VPC topology, Shared VPC, Cloud Interconnect/VPN, Cloud NAT, DNS, Cloud Armor, Traffic Director.
Design and build networking infrastructure — VPCs, subnets, DNS, load balancers, firewall rules. Use when asked to "set up networking", "VPC design", "configure DNS", "load balancer setup", "network architecture", or "firewall rules".
Designs and builds networking infrastructure: VPCs, subnets, DNS, load balancers, firewall rules. For cloud IaC projects using Terraform/Pulumi; activates on networking setup, VPC design, DNS config requests.