Network Connectivity linked spokes support hybrid spoke filters
Introduced 2026-03-24 · score 0.96
HOW TO USE IT
When creating or updating a linked router appliance, interconnect attachment, or VPN tunnel spoke, set the include and exclude import/export range flags to filter routes. Supply only the ranges you need; on create, also provide the hub and linked resource arguments.
gcloud network-connectivity spokes linked-router-appliances update <SPOKE> --region=<REGION> --include-import-ranges=<CIDR,...> --exclude-import-ranges=<CIDR,...> --include-export-ranges=<CIDR,...> --exclude-export-ranges=<CIDR,...>gcloud network-connectivity spokes linked-interconnect-attachments create <SPOKE> --region=<REGION> --hub=<HUB> --interconnect-attachments=<ATTACHMENT_URI,...> --include-import-ranges=<CIDR,...> --exclude-import-ranges=<CIDR,...> --include-export-ranges=<CIDR,...> --exclude-export-ranges=<CIDR,...>gcloud network-connectivity spokes linked-vpn-tunnels create <SPOKE> --region=<REGION> --hub=<HUB> --vpn-tunnels=<TUNNEL_URI,...> --include-import-ranges=<CIDR,...> --exclude-import-ranges=<CIDR,...> --include-export-ranges=<CIDR,...> --exclude-export-ranges=<CIDR,...>WHY THIS HELPS
Configure hybrid spoke filters for linked router appliances, interconnect attachments, or VPN tunnels.
REQUIREMENTS AND LIMITATIONS
- <SPOKE> (required): Spoke ID or fully qualified spoke identifier.
- --region (required): Spoke location; can be omitted if the spoke identifier is fully qualified.
- --hub (required): Hub for the new spoke; it must already exist.
- --interconnect-attachments (required): Existing VLAN attachment resources linked to the spoke.
- --vpn-tunnels (required): Existing HA VPN tunnel resources linked to the spoke.
- --include-import-ranges: Import hub routes fully encompassed by the ranges; empty means no hub subnets, with a site-to-site data transfer exception documented for IPv4 dynamic routes.
- --exclude-import-ranges: Exclude hub routes overlapped or encompassed by these ranges during import.
- --include-export-ranges: Export dynamic routes fully encompassed by these ranges; empty means export all dynamic routes.
- --exclude-export-ranges: Exclude dynamic routes overlapped or encompassed by these ranges during export.
- --router-appliance (required): On create, specify one or more router appliance instances and IP addresses; on update, optional and replaces the linked instance set when supplied.
- Prerequisite: For create commands, the hub and linked resources must already exist.
- Prerequisite: Updating spokes requires `networkconnectivity.spokes.update` permission; documented roles include Spoke Admin and Hub & Spoke Admin.
- The flags apply to the listed linked-router-appliances, linked-interconnect-attachments, and linked-vpn-tunnels create and update commands.
FIRST-PARTY EVIDENCE
- https://docs.cloud.google.com/sdk/docs/release-notes#56200_2026-03-24
- https://docs.cloud.google.com/sdk/gcloud/reference/network-connectivity/spokes/linked-router-appliances/update
- https://docs.cloud.google.com/sdk/gcloud/reference/network-connectivity/spokes/linked-interconnect-attachments/create
- https://docs.cloud.google.com/sdk/gcloud/reference/network-connectivity/spokes/linked-vpn-tunnels/create
- https://docs.cloud.google.com/sdk/gcloud/reference/network-connectivity/spokes/linked-router-appliances/create
- https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes
Check the installed version and the source before using it. Entry JSON