Mesh networking
Configure the node transport used by regional workload networking.
The mesh connects nodes that participate in a region's software-defined network. It transports managed workload traffic over the available physical network. Project networks remain isolated above that transport.
Underlay prerequisites
Nodes need stable management addresses, reachable transport endpoints, consistent MTU configuration, and synchronized time. The physical network must permit the configured peer transport and required control connections.
A node's management reachability and mesh reachability are distinct checks. An agent can report to the control plane while workload traffic between nodes is broken. Validate both before uncordoning.
Configure a region
Under Fleet → Region → Networking, select the transport interface, advertised endpoint, mesh address range, and MTU. The mesh address range must not overlap project subnets or management routes.
Choose the host interface and endpoint that other nodes can actually reach. A management address can be valid for enrollment while unsuitable as a transport endpoint across zones.
Allocate a mesh range that does not overlap project or management routes. Set MTU after accounting for the underlay's smallest path and encapsulation overhead. The encryption policy selects the region's supported transport configuration; it does not change project firewall authorization.
Configuration validation rejects overlapping ranges and invalid addresses. A syntactically valid endpoint can still be unreachable; the peer health check reports that condition after configuration is applied.
MTU and path validation
Encapsulation consumes part of the physical packet size. Set the guest-facing MTU below the smallest usable path MTU after transport overhead. A mismatch can allow small requests while larger responses stall.
Test across every relevant node pair and physical segment, including gateways and backup paths. Do not infer mesh health from a single successful agent heartbeat or a ping that stays on the same host.
Keys and identity
Node mesh credentials derive from registered node identities. Rotation creates an operation with peer adoption status. Nodes that cannot receive new identity material can lose connectivity when the previous credential expires.
Retiring a node revokes its managed identity and removes its transport membership. Do not clone node state or reuse an old identity for replacement hardware. See Enrollment and Secrets.
Troubleshoot peer health
Open Region → Mesh to inspect peer reachability, handshakes, packet loss, and applied configuration revisions. Compare failures by zone, host interface, and transport path. A zone-wide failure commonly requires checking the shared physical path before changing individual guests.
Changes to mesh endpoints or MTU can affect every attached workload. Apply them through a maintenance plan, verify a small set of nodes, and retain a management path independent of the mesh.
Follow MTU diagnosis when small connections work but larger transfers stall. Check time synchronization separately when agent trust or signed requests fail despite network reachability.