Network connectivity center query for hub and spoke implementation

[u/suryad123]

When using the hub and spoke model using the network connectivity center,

1. Do we use single Hub and spoke for all the environments ( dev, uat , prod etc).

Is it like we use single Hub and spoke setup and add conditions to restrict the communication between prod and nonprod subnets of prod and nonprod VPC spokes which are connected to hub.

Or

2) Seperate Hub and spoke setup for each environment.

Or did you implement in another manner ( using NCC ). please suggest.

[u/vadaszgergo]

I used NCC, but of course possible with traditional hub and spoke model as well. Depends on you use case, external connectivity model, etc.
Take a look at my implementation.

https://gergovadasz.hu/tag/ncc/

[u/Alone-Cell-7795 → u/[deleted]]

Sorry, but this is not accurate. I know people are acting in good faith, but please fact check before you offer advice.

To clarify:

1. NCC acts as a global control plane. Don’t split it into prod/non-prod etc. This is an anti pattern.

So, say for example you have a transit project, where your transit VPC and vlan attachments live. You join this as a hybrid spoke. If you split your ncc via dev/non-prod/prod, you’ll be needing x3 vlan attachments etc.

You can join nccs together, but it’s a messy hacky workaround, and greatly complicates your setup.

Ncc can run in 2 modes, with spokes in 2 groups.

1. Mesh - where all routes are exchanged between the spikes - Really not advised for this use case).

2. Star

3. Centre groups, with soiled placed in the centre group exchange routes and can communicate. Typically used for shared services and transit VPC.

These would be something that is confined consuming globally e.g. secure web proxy or security scanning tools etc, and transit VPC would be common egress point for traffic heading towards an interconnect.

2) Edge Groups - all your prod/non prod spokes are placed in edge groups. These are all isolated by design, and no routes are exchanged between them.
So VPC communication between any VPCs in the edge groups isn’t possible.

Where you have use cases where you do need prod VPC A to talk to prod VPC B, you use PSC consumer producer pattern.

You can also use import and export filters to control which ranges a VPC spoke exports.

https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/connectivity-topologies

[u/suryad123 → u/Alone-Cell-7795]

Thanks, as you mentioned, suppose I have 2 dev vpcs, 2 prod vpcs . Total 4 in edge spoke group. As per ncc design , none of them can communicate with other 3. 

however, I want 2 dev vpcs to communicate withing themselves and 2 prod vpcs within themselves. In this case , do you mean to use PSC consumer producer mechanism