VPC segmentation across regions
Group regional networks under one policy boundary without assuming one shared address space.
A VPC groups regional network segments under shared project ownership and connectivity policy. Each segment retains its own network ID, subnets, routes, and realization state.
Add a segment
Create a VPC under Networking → VPCs, select its project, and attach permitted regional networks. Address ranges must satisfy the planned route exchanges. Overlapping isolated ranges are rejected when a requested connection would make them ambiguous.
A droplet attaches to a network in its own region, not to a global interface. A volume and its guest also retain their regional storage requirement. VPC membership does not make a cross-region live migration possible.
Connect explicitly
Choose which segments exchange approved prefixes and which remain isolated. The default is no inter-segment forwarding. A permitted connection uses the region's supported private transport or gateway and remains subject to firewall policy.
Shared policy can define required firewall baselines and allowed connection classes. It does not turn all project subnets into trusted application sources. A database segment can remain restricted even when another segment hosts a public load balancer.
DNS and external routes
Private-zone visibility must be configured for the intended segments. Resolving a remote service name does not establish a route, and a route does not publish its service records.
External circuits attach to selected segments through private connectivity. Export only the permitted prefixes. The VPC does not re-export a received default route or another project's peering transit automatically.
Changes and retirement
Segment policy changes show target networks and applied revisions per region. A partial rollout can leave regions on different revisions; inspect that state before declaring isolation complete.
Removing a segment requires withdrawing its connections and shared policy references. It does not delete its droplets or regional network unless explicitly requested through their independent lifecycle. Use Network API for regional resources and firewall rollout for propagation.