{
  "slug": "network-connectivity-linked-spokes-support-hybrid-spoke-filters-f0f6a35c3b37",
  "title": "Network Connectivity linked spokes support hybrid spoke filters",
  "tools": [
    "gcloud"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-03-24T00:00:00.000Z",
  "announced_at": "2026-03-24T00:00:00.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When creating or updating a linked router appliance, interconnect attachment, or VPN tunnel spoke, set the include and exclude import/export range flags to filter routes. Supply only the ranges you need; on create, also provide the hub and linked resource arguments.",
    "examples": [
      "gcloud network-connectivity spokes linked-router-appliances update <SPOKE> --region=<REGION> --include-import-ranges=<CIDR,...> --exclude-import-ranges=<CIDR,...> --include-export-ranges=<CIDR,...> --exclude-export-ranges=<CIDR,...>",
      "gcloud network-connectivity spokes linked-interconnect-attachments create <SPOKE> --region=<REGION> --hub=<HUB> --interconnect-attachments=<ATTACHMENT_URI,...> --include-import-ranges=<CIDR,...> --exclude-import-ranges=<CIDR,...> --include-export-ranges=<CIDR,...> --exclude-export-ranges=<CIDR,...>",
      "gcloud network-connectivity spokes linked-vpn-tunnels create <SPOKE> --region=<REGION> --hub=<HUB> --vpn-tunnels=<TUNNEL_URI,...> --include-import-ranges=<CIDR,...> --exclude-import-ranges=<CIDR,...> --include-export-ranges=<CIDR,...> --exclude-export-ranges=<CIDR,...>"
    ],
    "gotchas": [
      "<SPOKE> (required): Spoke ID or fully qualified spoke identifier.",
      "--region (required): Spoke location; can be omitted if the spoke identifier is fully qualified.",
      "--hub (required): Hub for the new spoke; it must already exist.",
      "--interconnect-attachments (required): Existing VLAN attachment resources linked to the spoke.",
      "--vpn-tunnels (required): Existing HA VPN tunnel resources linked to the spoke.",
      "--include-import-ranges: Import hub routes fully encompassed by the ranges; empty means no hub subnets, with a site-to-site data transfer exception documented for IPv4 dynamic routes.",
      "--exclude-import-ranges: Exclude hub routes overlapped or encompassed by these ranges during import.",
      "--include-export-ranges: Export dynamic routes fully encompassed by these ranges; empty means export all dynamic routes.",
      "--exclude-export-ranges: Exclude dynamic routes overlapped or encompassed by these ranges during export.",
      "--router-appliance (required): On create, specify one or more router appliance instances and IP addresses; on update, optional and replaces the linked instance set when supplied.",
      "Prerequisite: For create commands, the hub and linked resources must already exist.",
      "Prerequisite: Updating spokes requires `networkconnectivity.spokes.update` permission; documented roles include Spoke Admin and Hub & Spoke Admin.",
      "The flags apply to the listed linked-router-appliances, linked-interconnect-attachments, and linked-vpn-tunnels create and update commands."
    ]
  },
  "why_it_matters": "Configure hybrid spoke filters for linked router appliances, interconnect attachments, or VPN tunnels.",
  "sources": [
    "https://docs.cloud.google.com/sdk/docs/release-notes#56200_2026-03-24",
    "https://docs.cloud.google.com/sdk/gcloud/reference/network-connectivity/spokes/linked-router-appliances/update",
    "https://docs.cloud.google.com/sdk/gcloud/reference/network-connectivity/spokes/linked-interconnect-attachments/create",
    "https://docs.cloud.google.com/sdk/gcloud/reference/network-connectivity/spokes/linked-vpn-tunnels/create",
    "https://docs.cloud.google.com/sdk/gcloud/reference/network-connectivity/spokes/linked-router-appliances/create",
    "https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes"
  ],
  "rank": 0.96023,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v1+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "cloud-20261008",
    "verdict_id": "cloud-20261008:cloud-20261008-5dfc56a5662d833f-16:gate",
    "evidence_hash": "ea8359a0f061776797b5be87b0e0c319fe95f45bf021d553dafb58809c26aec9"
  },
  "review": {
    "draft_hash": "e62f010b7d52bfcdb2a28517e6536fe7130e7a5e2f1abe79e296bdb7c1fe6cfb",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "cloud-20261008:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.96 >= 0.9; 2 needed) and Jev gave 0.69 (>= 0.6 needed)."
  }
}