initial version

kb/patterns/networking-hub-spoke/hub-spoke-drg.yaml

@@ -0,0 +1,86 @@
+# Pattern: Hub-Spoke Network Topology via DRG
+# Composable architecture block for enterprise networking
+
+pattern:
+  name: "Hub-Spoke Network via DRG"
+  id: hub_spoke_drg
+  category: networking
+
+description: |
+  Hub-spoke topology using OCI Dynamic Routing Gateway (DRG) v2 as the central
+  routing hub. Spoke VCNs attach to the DRG for inter-VCN routing, on-premises
+  connectivity (FastConnect/VPN), and centralized security inspection.
+
+topology:
+  hub:
+    components:
+      - "DRG (Dynamic Routing Gateway) — central router"
+      - "Hub VCN (optional) — for shared services, Network Firewall, Bastion"
+      - "Service Gateway — OCI service access without internet"
+      - "NAT Gateway — outbound internet for private subnets"
+      - "Network Firewall (optional) — deep packet inspection, IDS/IPS"
+  spokes:
+    components:
+      - "Spoke VCN per workload/environment"
+      - "VCN attachment to DRG"
+      - "Route table on DRG attachment for traffic steering"
+
+use_when:
+  - "Multiple workloads or environments needing isolation"
+  - "On-premises connectivity via FastConnect or VPN"
+  - "Centralized security inspection required"
+  - "Shared services (Bastion, DNS, NTP) across workloads"
+  - "Enterprise landing zone deployment"
+
+when_not_to_use:
+  - "Single VCN deployment (no need for hub-spoke complexity)"
+  - "< 3 VCNs and no on-prem connectivity"
+  - "POC or dev-only environment"
+
+preconditions:
+  - "DRG v2 (default in all regions)"
+  - "Non-overlapping CIDR ranges across VCNs"
+  - "Sufficient IP address planning"
+
+implied_services:
+  - service: drg
+    reason: "Central routing hub"
+  - service: vcn
+    reason: "Hub and spoke VCNs"
+  - service: service_gateway
+    reason: "OCI service access"
+  - service: nat_gateway
+    reason: "Outbound internet for private subnets"
+  - service: route_tables
+    reason: "Traffic steering via DRG attachments"
+
+optional_services:
+  - service: network_firewall
+    when: "Deep packet inspection, IDS/IPS required"
+    placement: "Hub VCN, inline between DRG and spokes"
+  - service: fastconnect
+    when: "On-premises connectivity"
+  - service: vpn
+    when: "Backup connectivity or lower-cost option"
+
+conflicts:
+  - pattern: "local_peering"
+    reason: "DRG replaces local peering for inter-VCN routing. Don't mix both."
+
+cidr_guidance:
+  - "Use /16 per VCN for growth headroom"
+  - "Use /24 per subnet (251 usable IPs)"
+  - "Reserve /8 or /12 supernet for all OCI CIDRs"
+  - "Avoid overlapping with on-prem ranges"
+  - "Example: 10.0.0.0/16 (hub), 10.1.0.0/16 (spoke 1), 10.2.0.0/16 (spoke 2)"
+
+cost_impact:
+  - "DRG: free (no charge for the gateway itself)"
+  - "VCN peering via DRG: no data transfer charges within same region"
+  - "Cross-region via DRG: data transfer charges apply"
+  - "Network Firewall: per-hour + per-GB processing"
+  - "FastConnect: port fee + data transfer (inbound free)"
+
+references:
+  - "https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/managingDRGs.htm"
+  - "https://docs.oracle.com/en/solutions/hub-spoke-network-drg/"

kb/patterns/networking-hub-spoke/pattern.yaml

@@ -0,0 +1,72 @@
+---
+last_verified: 2026-03-14
+pattern: Hub-and-Spoke Networking
+category: networking
+---
+
+description: |
+  Hub-and-spoke VCN topology for enterprise OCI deployments.
+  Centralizes shared services (firewalls, DNS, connectivity) in a hub VCN
+  with spoke VCNs for workloads.
+
+architecture:
+  hub_vcn:
+    purpose: "Shared services, connectivity, security inspection"
+    components:
+      - "DRG (Dynamic Routing Gateway)"
+      - "Network Firewall (optional)"
+      - "DNS resolver"
+      - "FastConnect / VPN termination"
+      - "Bastion service"
+      - "Management subnet"
+    cidr_example: "10.0.0.0/16"
+
+  spoke_vcns:
+    purpose: "Workload isolation"
+    examples:
+      - name: "Production"
+        cidr: "10.1.0.0/16"
+        subnets:
+          - "Public subnet (LB): 10.1.0.0/24"
+          - "Private subnet (App): 10.1.1.0/24"
+          - "Private subnet (DB): 10.1.2.0/24"
+      - name: "Non-Production"
+        cidr: "10.2.0.0/16"
+      - name: "DMZ"
+        cidr: "10.3.0.0/16"
+
+  connectivity:
+    hub_to_spoke: "VCN attachments via DRG"
+    spoke_to_spoke: "Transit routing through DRG (no direct peering needed)"
+    on_prem: "FastConnect or VPN to DRG in hub"
+
+when_to_use:
+  - "Multiple environments (prod, non-prod, DMZ)"
+  - "Centralized connectivity to on-prem"
+  - "Security inspection required between workloads"
+  - "Shared services (DNS, NTP, monitoring) across workloads"
+
+when_NOT_to_use:
+  - "Single-VCN deployments"
+  - "Simple architectures with 1-2 workloads"
+
+ip_planning:
+  recommendation: |
+    Plan CIDR ranges before deployment. Overlapping CIDRs prevent peering.
+    Use /16 for VCNs, /24 for subnets. Reserve ranges for future growth.
+  example_scheme:
+    hub: "10.0.0.0/16"
+    production: "10.1.0.0/16"
+    non_production: "10.2.0.0/16"
+    dmz: "10.3.0.0/16"
+    dr_region: "10.128.0.0/9"
+
+gotchas:
+  - id: HUB-001
+    issue: "DRG route table limits"
+    impact: "Max 200 route rules per DRG route table"
+    recommendation: "Aggregate routes where possible, plan for scale"
+  - id: HUB-002
+    issue: "Network Firewall throughput"
+    impact: "Inspect all traffic adds latency and cost"
+    recommendation: "Only inspect north-south and selected east-west traffic"