A shared VPC lets resources in Google Cloud service projects use a network owned by a host project. For an Anthos deployment, this separates network ownership from the projects that hold clusters and other resources. It is an alternative to putting every team and resource in one project and one flat VPC. Choose the architecture early: a single VPC is simpler to administer, but project separation and VPC limits can make that design unsuitable as an organization grows. section 10.1.1 section 10.3.1
A multicluster arrangement uses one network host project and multiple service projects. The platform administrators’ service project holds Anthos GKE clusters shared by tenants; a separate product service project holds product resources. VPC-native clusters use VPC IP addresses for Pods, allowing direct Pod-to-Pod connectivity across clusters. Regions, subnets, clusters, and tenant namespaces can then be organized around the platform’s resiliency and isolation needs. section 10.3.1
Use the single-environment architecture figure to locate the network host project, service projects, and regional Anthos clusters in one deployment. section 10.3.1
Plan host-project permissions before deploying Ingress. A GKE Ingress controller running from a service project manages firewall rules for load-balancer and health-check traffic, but its Google Cloud service account may lack rights to change network resources in the host project. If policy reserves firewall management for the host project, a network administrator can provision the required rule manually. Inspect the Ingress event with `kubectl describe ingress INGRESS_NAME`; the event supplies the needed firewall change. Treat that command as deployment-specific rather than copying an example rule unchanged. section 10.2.1
Do not assume container-native load balancing is enabled by default on a shared VPC. The stated default conditions explicitly exclude shared VPC clusters. Where network endpoint groups are not the default, enable container-native load balancing per Service with the `cloud.google.com/neg` annotation; use a `ClusterIP` Service for that arrangement. section 10.2.1
