Draft: feat(network): add doc for new routing behavior #4927
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
RoRoJ
added
do not merge
|
|
||
| Each routed VPC has a [route table](#route-table) which is automatically populated with routes to each Private Network in the VPC, as well as to any attached Public Gateways. These routes allow the VPC to automatically route packets between its Private Networks, or from a given Private Network to its attached Public Gateway when the destination is outside the VPC. You can also create your own [custom routes](/vpc/how-to/manage-routing/#how-to-create-a-custom-route). | ||
| <Message type="note"> | ||
| If you have [updated](/vpc/how-to/manage-routing/#how-to-update-routing-behavior) routing behavior on your VPC, or created a VPC since TODODATE, routing takes on the following characteristics: |
There was a problem hiding this comment.
Just so you don't forget to update the THEDODATE here
|
|
||
| Two types of auto-generated routes exist: | ||
| If you created your VPC before TODODATE, you must manually update its routing behavior in order to get the following capabilities: |
There was a problem hiding this comment.
Same her, with the TODODATE
| @@ -87,7 +162,9 @@ Each VPC has auto-generated, managed routes to local subnets and Public Gateways | |||
| For example, you may wish to route all traffic for a certain private IP range to an Instance hosting a manually configured VPN tunnel, allowing secure connection to a corresponding subnet at the other end of the tunnel. | |||
|
|
|||
| <Message type="note"> | |||
| Custom routes are scoped to the Private Network(s) of the "next hop" resource. Their routes are not propagated to other Private Networks in the VPC. In the scenario mentioned above of routing traffic towards a VPN tunnel, the origin of the packet must be in the same Private Network as the resource hosting the VPN. | |||
| The scope of custom routes depends on whether your VPC is using up-to-date routing behavior: | |||
| - If you created your VPC after TODODATE, or have [manually updated its routing behavior](#how-to-update-routing-behavior), custom routes are advertised across the entire VPC. | |||
There was a problem hiding this comment.
TODODATE to update too
| @@ -77,6 +73,89 @@ We recommend that you build your VPC infrastructure with **separation of concern | |||
|
|
|||
| For example, you may use one Private Network for frontend resources and another for backend resources, limiting public access only via Load Balancers and/or Public Gateways. | |||
|
|
|||
| ## Updating routing behavior | |||
|
|
|||
| From TODO DATE, new routing behavior is available for VPCs. | |||
|
|
||
| ### Example use of NACLs to mitigate impact | ||
|
|
||
| The example below shows how to achieve desired routing behavior for a custom route which is now advertised across the whole VPC. |
There was a problem hiding this comment.
Suggested change
| The example below shows how to achieve desired routing behavior for a custom route which is now advertised across the whole VPC. | |
| The example below shows how to achieve the desired routing behavior for a custom route which is now advertised across the whole VPC. |
|
|
||
| Your Private Networks will continue to receive only their local default route announcements, **unless** you enable `Receive all default route announcements` in each Private Network's settings. Therefore, there is no risk of the scope of default route announcements automatically changing without your specific intervention, even after updating to new routing behavior. | ||
|
|
||
| Your existing setup may be impacted by the new behavior if you want your custom routes to be scoped only to the next-hop resource's Private Network. In this case we recommend that you use [Network ACL rules](/vpc/reference-content/understanding-acls) via the VPC API to limit access to the custom route. |
There was a problem hiding this comment.
Suggested change
| Your existing setup may be impacted by the new behavior if you want your custom routes to be scoped only to the next-hop resource's Private Network. In this case we recommend that you use [Network ACL rules](/vpc/reference-content/understanding-acls) via the VPC API to limit access to the custom route. | |
| Your existing setup may be impacted by the new behavior if you want your custom routes to be scoped only to the next-hop resource's Private Network. In this case, we recommend that you use [Network ACL rules](/vpc/reference-content/understanding-acls) via the VPC API to limit access to the custom route. |
|
|
||
| From TODO DATE, new routing behavior is available for VPCs. | ||
|
|
||
| - This routing behavior will be applied automatically to VPCs created after TODO DATE, or to pre-existing VPCs that only activate routing after this date. |
jcirinosclwy
approved these changes
May 30, 2025
Co-authored-by: Jessica <[email protected]>
Co-authored-by: Jessica <[email protected]>
Co-authored-by: Jessica <[email protected]>
Co-authored-by: Jessica <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Modify doc for updated routing behavior, impacting VPC and PGW.