Google Cloud: Shared VPC and App Engine

Question

I'm using Google Cloud with the following setup:

Shared VPC Host Project: has a network called 'production' with a subnet called 'app1', is shared among all other projects.

App1 Project: has a VM instance and an App Engine running on Node. The VM instance is directly connected to the shared VPC network's subnet.

The problem is that it seems impossible to connect the App Engine to the same network. When I insert the parameters in the app.yaml file it says that the network could not be found (it searches on the current project only).

So, how do I connect the App Engine instances to the VM? I've tried creating a network peering with no success.

Solution 1

Finally it's possible with AppEngine Flex: https://cloud.google.com/appengine/docs/flexible/nodejs/using-shared-vpc

In the app.yaml file, use the network settings name field to specify the fully-qualified name of the Shared VPC network:

network: name: projects/HOST_PROJECT_ID/global/networks/NETWORK_NAME

where

HOST_PROJECT_ID is the GCP project ID of the Shared VPC host project. NETWORK_NAME is the name of the Shared VPC network.

To configure the service to be part of a subnetwork named SUBNETWORK_NAME, also set >the subnetwork_name field:

network: name: projects/HOST_PROJECT_ID/global/networks/NETWORK_NAME subnetwork_name: SUBNETWORK_NAME

Solution 2

After some investigation regarding what you want to achieve, there are several points you can check:

• First of all, I would like you to confirm that the app1 subnetwork is in the same region as the App Engine application you are trying to deploy. Bear in mind, that, as stated in the documentation, a subnet must be in the same region as the application that is trying to connect to it. Otherwise, the subnet not found error can appear. You can specify the region (e.g. us-central) in your subnet following these steps; it must be the same region (us-central in this example) as where your App Engine application is running. You cannot change an app's region after you set it when you created your application, so you can check where it is located going to the App Engine Dashborard or running the command gcloud app describe.
• You can also try VPC Peering, which is suitable for connecting Compute Engine instances to App Engine applications. To do so, you can follow the steps detailed in this set-up walkthrough.

Solution 3

Unfortunately, you cannot connect Google App Engine (GAE) to a network shared via a Shared VPC. From the Shared VPC docs:

• GAE Flexible in a service project associated with a shared VPC network is not supported.

As suggested, you could use VPC peering or you can setup a VPN connection between your projects to connect GAE to your VM

Comments

[John White]

Thanks, I didn't find that piece of information. Actually I already tried VPC peering, with no success. Is there something particular I can do to debug this? The peering is active, but the traffic can't be routed. Maybe I should dig it a little more and in case post another question.

[John White]

Nevermind, solved it! It was a firewall rule

[Tudormi]

@Mc128k can you please un-tick this answer as the accepted one and post your own solution as an answer?

[John White]

Actually this was useful. I used VPC peering, and what initially seemed not working was because I forgot to add a firewall rule.