Network routing contract
Purpose: Define the address plan, ASNs, tunnel link ranges, and route-policy boundaries for HybridOps.Studio hybrid connectivity (GCP NCC hub with routed on‑prem and Azure spokes), as established by ADR-0109 and constrained by the VLAN plan in ADR-0101.
Maintainer: HybridOps.Studio
Scope
This contract defines:
- Routing identities (ASNs) for on‑prem, GCP, and Azure.
- Non-overlapping address ranges for on‑prem, GCP, and Azure.
- Link networks for BGP over route‑based IPsec tunnels (VTI / HA VPN / VPN Gateway).
- Route exchange boundaries (what is advertised, what is accepted, and what is rejected).
Role model
- On-prem routed edges default to VyOS on Proxmox.
- Hetzner routed edges default to VyOS when Hetzner participates as an edge site.
- The Hetzner shared control-plane host is a separate Linux service host for DNS, runners, and decision/control services.
- GCP remains the cloud-side routing hub using Cloud Router + HA VPN + NCC.
- Azure remains a routed spoke using cloud-native gateway constructs.
Multi‑WAN is an additive change: additional tunnels and peers follow the same contract and do not change the routing model described in ADR-0109.
Regions
- GCP hub region:
europe-west2 (London)
- Azure region:
UK South
Autonomous systems
| Domain |
ASN |
Notes |
| On‑prem (Site‑A) |
65010 |
Site ASN used at the edge. Multiple edges may use iBGP internally while maintaining eBGP to the hub. |
| GCP Cloud Router (hub) |
64514 |
Cloud Router ASN for HA VPN and NCC hub routing. |
| Azure VPN Gateway |
65515 |
Azure VPN Gateway ASN for inter‑cloud peering to GCP Cloud Router. |
Address plan
On‑prem VLAN VNets
| Segment |
VLAN |
CIDR |
Notes |
| Management |
10 |
10.10.0.0/24 |
Control-plane and platform management. |
| Observability |
11 |
10.11.0.0/24 |
Metrics, logging, dashboards. |
| Data / shared services |
12 |
10.12.0.0/24 |
PostgreSQL, NetBox, shared dependencies. |
| Development |
20 |
10.20.0.0/24 |
Dev workloads. |
| Staging |
30 |
10.30.0.0/24 |
Staging workloads. |
| Production |
40 |
10.40.0.0/24 |
Production workloads. |
| Lab |
50 |
10.50.0.0/24 |
Network lab and experiments. |
GCP
| Segment |
CIDR |
Notes |
| Hub VPC (NCC attachment) |
10.70.0.0/16 |
Hub routing domain for NCC and Cloud Router adjacency. |
| Workload subnet (example) |
10.70.16.0/20 |
Example workload subnet; additional subnets stay within 10.70.0.0/16. |
Azure
| Segment |
CIDR |
Notes |
| Azure VNet |
10.60.0.0/16 |
Primary Azure routing domain for AKS/AVD access. |
| GatewaySubnet (example) |
10.60.0.0/27 |
Reserved for VPN Gateway. |
| Workloads (example) |
10.60.16.0/20 |
Example workload subnet; additional subnets stay within 10.60.0.0/16. |
Kubernetes service networks
| Domain |
Pods CIDR |
Services CIDR |
Policy |
| Platform clusters |
172.21.0.0/16 |
172.22.0.0/16 |
Not advertised by default. Expose services via ingress/LB. Advertise only when explicitly required and filtered. |
Tunnel link networks
Use link‑local address space for BGP session IPs over each route‑based tunnel:
- Allocation pool:
169.254.0.0/16
- Each BGP session uses a dedicated
/30.
| Link |
Purpose |
Link /30 |
Left IP |
Right IP |
| On‑prem ↔ GCP HA VPN (tunnel A) |
Primary site‑to‑hub |
169.254.10.0/30 |
169.254.10.1 (On‑prem) |
169.254.10.2 (GCP) |
| On‑prem ↔ GCP HA VPN (tunnel B) |
Redundancy |
169.254.10.4/30 |
169.254.10.5 (On‑prem) |
169.254.10.6 (GCP) |
| Azure VPN GW ↔ GCP Cloud Router (tunnel A) |
Inter‑cloud spoke |
169.254.20.0/30 |
169.254.20.1 (Azure) |
169.254.20.2 (GCP) |
| Azure VPN GW ↔ GCP Cloud Router (tunnel B) |
Redundancy |
169.254.20.4/30 |
169.254.20.5 (Azure) |
169.254.20.6 (GCP) |
Notes:
- Link networks are not advertised. Filters must reject
169.254.0.0/16 in both directions.
- Multi‑WAN adds additional
/30 allocations from the same pool per WAN edge/tunnel.
Route exchange policy
Export
| Speaker |
Export to |
Advertise |
Do not advertise |
| On‑prem (ASN 65010) |
GCP Cloud Router |
10.10.0.0/24, 10.11.0.0/24, 10.12.0.0/24, 10.20.0.0/24, 10.30.0.0/24, 10.40.0.0/24, 10.50.0.0/24 |
169.254.0.0/16, 172.21.0.0/16, 172.22.0.0/16, any RFC1918 outside on‑prem allocations. |
| Azure (ASN 65515) |
GCP Cloud Router |
10.60.0.0/16 |
169.254.0.0/16, 172.21.0.0/16, 172.22.0.0/16. |
| GCP (ASN 64514) |
On‑prem + Azure |
10.70.0.0/16 |
169.254.0.0/16, 172.21.0.0/16, 172.22.0.0/16. |
Import
| Receiver |
Accept |
Reject |
| GCP Cloud Router |
Approved on‑prem VLAN prefixes and approved Azure VNet prefixes |
Any unknown RFC1918, 169.254.0.0/16, Kubernetes pod/service CIDRs unless explicitly enabled. |
| On‑prem edge |
10.70.0.0/16 and (optionally) 10.60.0.0/16 via hub |
Any unexpected RFC1918, 169.254.0.0/16, default routes unless explicitly engineered. |
| Azure VPN Gateway |
10.70.0.0/16 and approved on‑prem VLAN prefixes |
Any unexpected RFC1918, 169.254.0.0/16, default routes unless explicitly engineered. |
Safety controls
- Deny-by-default prefix filtering on all BGP sessions.
- Max-prefix per neighbor sized for the current design and increased only with evidence.
- Evidence capture: before/after BGP summaries, learned routes, and reachability checks.
Operational sequences are documented in the runbooks for NCC hub setup, on‑prem ↔ GCP VPN + BGP, and Azure ↔ GCP VPN + BGP.
References