Review proposed VPC spokes

As a hub administrator, you can review and subsequently accept or reject pending VPC spokes that a spoke administrator has proposed from a different project from the hub.

After a spoke is accepted or rejected, you can reject it or accept it as many times as necessary by running the commands described on this page. As a hub administrator, you can also reject spokes that have previously been accepted at any time. If a previously accepted spoke is rejected, it loses all its connectivity with other spokes after the rejection is complete.

Additionally, you can accept or reject updates to VPC spokes on the hub that are from different projects. The following spoke properties require your approval to update:

Whether the spoke exports IPv6 subnet ranges
Which subnet IPv4 address ranges are exported from the VPC spoke to the hub

For more information about updating spokes, see Update a spoke.

You can also set up auto-accept projects for spoke groups into a hub. Auto-accept lets you automatically accept into the hub any spokes or spoke updates that are in auto-accept projects, without having to review each spoke proposal.

Permissions required for this task

To perform this task, you must have been granted the following permissions or the following IAM roles.

Permissions

networkconnectivity.hubs.listSpokes to list spokes
networkconnectivity.groups.acceptSpoke on the hub to accept a spoke
networkconnectivity.groups.rejectSpoke on the hub to reject a spoke
networkconnectivity.groups.rejectSpokeUpdate on the hub to reject a spoke update
networkconnectivity.groups.acceptSpokeUpdate on the hub to accept a spoke update
networkconnectivity.groups.list on the hub to list groups
networkconnectivity.groups.get on the hub to get a group
networkconnectivity.groups.update on the hub to update a group

Roles

roles/networkconnectivity.hubAdmin

View proposals pending review

This section describes how to list all spoke proposals and view the details of an update proposal in Network Connectivity Center (NCC).

For spoke updates, you can compare existing values with proposed values to decide whether to accept or reject the updates.

Console

In the Google Cloud console, go to Network Connectivity Center.

Go to Network Connectivity Center
In the project menu, select the project that contains the hub for which you want to list the existing spokes.
In the Hub tab, select the hub.
Click the Spoke tab. All the spokes attached to that hub are listed.
To view the status for a specific spoke, check the Spoke status column.
- New proposed spokes that are pending review have an Inactive, pending status.
- Updates to existing spokes that are pending review have an Active, updates pending review status. The Spoke details page for a given spoke displays the proposed updates in the VPC spoke filter update message.

gcloud

To list proposals pending review, run the gcloud network-connectivity hubs list-spokes command.
```
gcloud network-connectivity hubs list-spokes HUB_NAME \
    --filter="reasons:STATE_REASON" \
    --format=yaml
```
Replace the following:
- HUB_NAME: the name of the hub for which you want to review proposals, such as my-hub.
- STATE_REASON: the state reason to filter on:
  - PENDING_REVIEW: Use this value to view new spoke proposals.
  - UPDATE_PENDING_REVIEW: Use this value to view proposals for updates to existing spokes. For spoke update proposals, the command output shows the proposed update in the proposed_include_export_ranges field.

API

To list proposals that are pending review for a hub, use the networkconnectivity.hubs.listSpokes method.
```
  GET https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs/HUB_NAME:listSpokes?filter=reasons=STATE_REASON
```
Replace the following values:
- PROJECT_ID: the project ID of the project that contains the spokes to list
- HUB_NAME: the name of the hub for which you want to view spoke proposals pending review
- STATE_REASON: the state reason to filter on:
  - PENDING_REVIEW: Use this value to view new spoke proposals.
  - UPDATE_PENDING_REVIEW: Use this value to view proposals for updates to existing spokes. For spoke update proposals, the response shows the proposed update in the proposed_include_export_ranges field.

Accept proposals for a new spoke or an update to an existing spoke

This section describes how to accept proposals for new spokes or updates to existing spokes.

Note: You can't accept a proposed producer VPC spoke on the hub until you accept the associated VPC spoke for the peered consumer network.

Console

In the Google Cloud console, go to Network Connectivity Center.

Go to Network Connectivity Center
In the project menu, select the project that contains the hub for which you want to list the existing spokes.
On the Hub tab, select the hub.
Click the Spoke tab. All the spokes attached to that hub are listed.
To view details for a specific spoke, click the spoke name.

If the spoke is an existing spoke with proposed updates, the Spoke details page displays the proposed updates.
To accept the proposal, click Accept spoke.
- For new spokes, click Accept spoke.
- For existing spokes, click Accept updates.
The NCC page updates to show details about the spokes that you accepted and the spoke status changes to Active.

You can also select multiple spokes for a bulk accept. However, as the hub administrator, before accepting a spoke, you must check the VPC spoke filters for each spoke by clicking the individual spoke name and checking the spoke details.

gcloud

To accept a proposed spoke to connect to a hub, run the gcloud network-connectivity hubs accept-spoke command.
```
  gcloud network-connectivity hubs accept-spoke HUB_NAME \
      --spoke=SPOKE_URI
```
Replace the following:
- HUB_NAME: the name of the hub that is receiving the spoke proposal
- SPOKE_URI: the URI of the spoke that you want to accept into the hub
To accept proposed updates to a spoke connected to a hub, follow these steps:
1. Follow the Google Cloud CLI instructions to list spokes and record the spoke's etag value from the output.
2. Run the gcloud network-connectivity hubs accept-spoke-update command.
```
gcloud network-connectivity hubs accept-spoke-update HUB_NAME \
    --spoke=SPOKE_URI \
    --spoke-etag=ETAG
```
  Replace the following:
  - HUB_NAME: the name of the hub that is receiving the spoke proposal
  - SPOKE_URI: the URI of the spoke that you want to accept into the hub
  - ETAG: the etag value of the VPC spoke for which you want to accept updates

API

To accept a proposed spoke, use the networkconnectivity.hubs.acceptSpoke method.
```
  POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs/HUB_NAME:acceptSpoke

  {
  "spokeUri": SPOKE_URI
  }
```
Replace the following:
- PROJECT_ID: the ID of the project that contains the hub
- HUB_NAME: the name of the hub that is receiving the spoke proposal
- SPOKE_URI: the URI of the spoke that you want to accept into the hub
To accept proposed updates to a spoke connected to a hub, follow these steps:
1. Follow the API instructions to list spokes and record the spoke's etag value from the output.
2. To accept proposed updates to a spoke, use the networkconnectivity.hubs.acceptSpokeUpdate method.
```
POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs/HUB_NAME:acceptSpokeUpdate

{
"spokeUri": SPOKE_URI,
"spokeEtag": ETAG
}
```
  Replace the following:
  - PROJECT_ID: the ID of the project that contains the hub
  - HUB_NAME: the name of the hub that is receiving the spoke proposal
  - SPOKE_URI: the URI of the spoke that you want to accept into the hub
  - ETAG: the etag value of the VPC spoke for which you want to accept updates

Reject a spoke proposal

This section describes how to reject proposals for new spokes or updates to existing spokes.

As a hub administrator, you can also reject spokes that have previously been accepted at any time. If a previously accepted spoke is rejected, it loses all its connectivity with other spokes after the rejection is complete.

Note: You can't reject a VPC spoke that is associated with an active producer VPC spoke on the hub. To reject an associated VPC spoke, first reject the producer VPC spoke.

Console

In the Google Cloud console, go to Network Connectivity Center.

Go to Network Connectivity Center
In the project menu, select the project that contains the hub for which you want to list the existing spokes.
In the Hub tab, select the hub.
Click the Spoke tab. All the spokes attached to that hub are listed.
To view details for a specific spoke, click the spoke name.

If the spoke is an existing spoke with proposed updates, the Spoke details page displays the proposed updates.
Depending on whether it's a new spoke or an update, do the following:
- For new spoke proposals:
  1. Click Reject spoke.
  2. In the Reject spoke? dialog, confirm the rejection and optionally, provide a reason for the rejection.
  3. Click Reject again. The NCC page updates to show details about the spokes that you rejected, and the spoke status shows as Inactive, rejected.
- For existing spoke updates:
  1. Click Reject updates.
  2. In the Reject updates? dialog, confirm the rejection and optionally, provide a reason for the rejection.
  3. Click Reject again. The NCC page updates to show details about the spokes that you rejected, and the spoke status shows as Active, updates rejected.

gcloud

To reject a proposed spoke from connecting to a hub, run the gcloud network-connectivity hubs reject-spoke command.
```
gcloud network-connectivity hubs reject-spoke HUB_NAME \
    --spoke=SPOKE_URI \
    --details=REJECT_REASON
```
Replace the following:
- HUB_NAME: the name of the hub that contains the spoke that you want to reject
- SPOKE_URI: the URI of the VPC spoke that you want to reject
- REJECT_REASON: Optional: the reason for which you rejected the spoke
To reject proposed updates to an existing spoke, follow these steps:
1. Follow the Google Cloud CLI instructions to list spokes and record the spoke's etag value from the output.
2. Run the gcloud network-connectivity hubs reject-spoke-update command.
```
gcloud network-connectivity hubs reject-spoke-update HUB_NAME \
    --spoke=SPOKE_URI \
    --spoke-etag=ETAG \
    --details=REJECT_REASON
```
  Replace the following:
  - HUB_NAME: the name of the hub that contains the spoke for which you want to reject updates
  - SPOKE_URI: the URI of the VPC spoke for which you want to reject updates
  - ETAG: the etag value of the VPC spoke for which you want to reject updates
  - REJECT_REASON: Optional: the reason for which you rejected the spoke

API

To reject a proposed spoke, use the networkconnectivity.hubs.rejectSpoke method.

  POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs/HUB_NAME:rejectSpoke

  {
  "spokeUri": SPOKE_URI,
  "requestId": REQUEST_ID,
  "details": SPOKE_DETAILS
  }

Review proposed VPC spokes Stay organized with collections Save and categorize content based on your preferences.

Permissions required for this task

View proposals pending review

Console

gcloud

API

Accept proposals for a new spoke or an update to an existing spoke

Console

gcloud

API

Reject a spoke proposal

Console

gcloud

API

Review proposed VPC spokes