> ## Documentation Index
> Fetch the complete documentation index at: https://clickhouse.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP customized setup

> Deploy ClickHouse BYOC into your existing GCP VPC

export const Image = ({img, alt, size = "lg"}) => {
  const normalizedSize = ["sm", "md", "lg"].includes(size) ? size : "lg";
  return <div className={`ch-image-${normalizedSize}`}>
      <Frame>
        <img src={img} alt={alt} />
      </Frame>
    </div>;
};

<h2 id="customer-managed-vpc-gcp">
  Customer-managed VPC (BYO-VPC) for GCP
</h2>

If you prefer to use an existing VPC to deploy ClickHouse BYOC instead of having ClickHouse Cloud provision a new VPC, follow the steps below. This approach provides greater control over your network configuration and allows you to integrate ClickHouse BYOC into your existing network infrastructure.

<Steps>
  <Step title="Configure your existing VPC" id="configure-existing-vpc">
    1. Allocate at least 1 private subnet in a [region supported by ClickHouse BYOC](/docs/products/cloud/reference/supported-regions) for the ClickHouse Kubernetes (GKE) cluster. Ensure the subnet has a minimum CIDR range of `/24` (e.g., 10.0.0.0/24) to provide sufficient IP addresses for GKE cluster nodes.
    2. Within the private subnet, allocate at least 1 secondary IPv4 range that will be used for GKE cluster pods. The secondary range should be at least `/23` to provide sufficient IP addresses for GKE cluster pods.
    3. Enable **Private Google Access** on the subnet. This allows GKE nodes to reach Google APIs and services without requiring external IP addresses.

    <Image img="https://mintcdn.com/private-7c7dfe99/REHSqgCLT_igIuJP/images/cloud/reference/byoc-gcp-subnet.webp?fit=max&auto=format&n=REHSqgCLT_igIuJP&q=85&s=ebe7e441fc49a78e6347dc97027a6c7e" size="lg" alt="BYOC GCP Subnet details showing primary and secondary IPv4 ranges with Private Google Access enabled" width="2337" height="1573" data-path="images/cloud/reference/byoc-gcp-subnet.webp" />
  </Step>

  <Step title="Ensure network connectivity" id="ensure-network-connectivity">
    **Cloud NAT Gateway**
    Ensure a [Cloud NAT gateway](https://cloud.google.com/nat/docs/overview) is deployed for the VPC. ClickHouse BYOC components require outbound internet access to communicate with the Tailscale control plane. Tailscale is used to provide secure, zero-trust networking for private management operations. The Cloud NAT gateway provides this outbound connectivity for instances without external IP addresses.

    **DNS Resolution**
    Ensure your VPC has working DNS resolution and doesn't block, interfere with, or overwrite standard DNS names. ClickHouse BYOC relies on DNS to resolve Tailscale control servers and ClickHouse service endpoints. If DNS is unavailable or misconfigured, BYOC services may fail to connect or operate properly.
  </Step>

  <Step title="Set up BYOC infrastructure" id="set-up-byoc-infrastructure">
    In the ClickHouse Cloud console, configure the following when setting up new infrastructure:

    1. Under **VPC configuration**, select **Use existing VPC**.
    2. Enter your **VPC network name**.
    3. Enter the **Subnet name** you allocated for ClickHouse.
    4. Click **Set up Infrastructure** to begin provisioning.

    <Image img="https://mintcdn.com/private-7c7dfe99/REHSqgCLT_igIuJP/images/cloud/reference/byoc-gcp-existing-vpc-ui.webp?fit=max&auto=format&n=REHSqgCLT_igIuJP&q=85&s=05af87cba697722e2021912739b0798d" size="lg" alt="ClickHouse Cloud BYOC setup UI with Use existing VPC selected for GCP" width="1182" height="1466" data-path="images/cloud/reference/byoc-gcp-existing-vpc-ui.webp" />
  </Step>
</Steps>