Add GCP BYO-VPC documentation and split customized setup into per-cloud pages

docs/cloud/guides/index.md

@@ -18,6 +18,7 @@ keywords: ['cloud guides', 'documentation', 'how-to', 'cloud features', 'tutoria
 | [Accessing GCS data securely](/cloud/data-sources/secure-gcs) | This article demonstrates how ClickHouse Cloud customers can access their GCS data securely |
 | [Accessing S3 data securely](/cloud/data-sources/secure-s3) | This article demonstrates how ClickHouse Cloud customers can leverage role-based access to authenticate with Amazon Simple Storage Service(S3) and access their data securely. |
 | [Architecture](/cloud/reference/byoc/architecture) | Deploy ClickHouse on your own cloud infrastructure |
+| [AWS Customized Setup](/cloud/reference/byoc/onboarding/customization-aws) | Deploy ClickHouse BYOC into your existing AWS VPC |
 | [AWS PrivateLink](/manage/security/aws-privatelink) | This document describes how to connect to ClickHouse Cloud using AWS PrivateLink. |
 | [Azure Private Link](/cloud/security/azure-privatelink) | How to set up Azure Private Link |
 | [Azure Private Preview](/cloud/reference/byoc/onboarding/azure-private-preview) | Onboard ClickHouse BYOC on Azure using the Terraform module and cross-tenant authentication |
@@ -37,13 +38,14 @@ keywords: ['cloud guides', 'documentation', 'how-to', 'cloud features', 'tutoria
 | [Connect to ClickHouse](/cloud/reference/byoc/connect) | Connect to your BYOC ClickHouse services via public, private, or PrivateLink endpoints |
 | [Connecting ClickHouse Cloud to Azure Blob Storage](/cloud/data-sources/secure-azure) | This article demonstrates how ClickHouse Cloud customers can access their Azure data securely |
 | [Console audit log](/cloud/security/audit-logging/console-audit-log) | This page describes how you can review the cloud audit log |
-| [Customized Setup](/cloud/reference/byoc/onboarding/customization) | Deploy ClickHouse on your own cloud infrastructure |
+| [Customized Setup](/cloud/reference/byoc/onboarding/customization) | Deploy ClickHouse on your own cloud infrastructure with a customized setup |
 | [Data encryption](/cloud/security/cmek) | Learn more about data encryption in ClickHouse Cloud |
 | [Data masking in ClickHouse](/cloud/guides/data-masking) | A guide to data masking in ClickHouse |
 | [Database audit log](/cloud/security/audit-logging/database-audit-log) | This page describes how you can review the database audit log |
 | [Deploying Additional Infrastructure](/cloud/reference/byoc/onboarding/new_region) | Deploy additional BYOC infrastructure in new regions or accounts |
 | [Export Backups to your Own Cloud Account](/cloud/manage/backups/export-backups-to-own-cloud-account) | Describes how to export backups to your own Cloud account |
 | [Gather your connection details](/cloud/guides/sql-console/gather-connection-details) | Gather your connection details |
+| [GCP Customized Setup](/cloud/reference/byoc/onboarding/customization-gcp) | Deploy ClickHouse BYOC into your existing GCP VPC |
 | [GCP private service connect](/manage/security/gcp-private-service-connect) | This document describes how to connect to ClickHouse Cloud using Google Cloud Platform (GCP) Private Service Connect (PSC), and how to disable access to your ClickHouse Cloud services from addresses other than GCP PSC addresses using ClickHouse Cloud IP access lists. |
 | [HIPAA onboarding](/cloud/security/compliance/hipaa-onboarding) | Learn more about how to onboard to HIPAA compliant services |
 | [Infrastructure Configuration](/cloud/reference/byoc/configurations) | Configure load balancers, node groups, and other BYOC infrastructure components |

docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/02_customization.md → docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/02_customization/01_aws.md

@@ -1,9 +1,9 @@
 ---
-title: 'Customized Setup'
-slug: /cloud/reference/byoc/onboarding/customization
-sidebar_label: 'Customized Setup'
-keywords: ['BYOC', 'cloud', 'bring your own cloud', 'onboarding']
-description: 'Deploy ClickHouse on your own cloud infrastructure'
+title: 'AWS Customized Setup'
+slug: /cloud/reference/byoc/onboarding/customization-aws
+sidebar_label: 'AWS Customized Setup'
+keywords: ['BYOC', 'cloud', 'bring your own cloud', 'onboarding', 'AWS', 'VPC']
+description: 'Deploy ClickHouse BYOC into your existing AWS VPC'
 doc_type: 'reference'
 ---
 
@@ -12,11 +12,7 @@ import byoc_subnet_1 from '@site/static/images/cloud/reference/byoc-subnet-1.png
 import byoc_subnet_2 from '@site/static/images/cloud/reference/byoc-subnet-2.png';
 import byoc_s3_endpoint from '@site/static/images/cloud/reference/byoc-s3-endpoint.png'
 
-## Customer-managed VPC (BYO-VPC) {#customer-managed-vpc}
-
-:::note
-This is only supported in **AWS** currently. GCP support is on the roadmap.
-:::
+## Customer-managed VPC (BYO-VPC) for AWS {#customer-managed-vpc-aws}
 
 If you prefer to use an existing VPC to deploy ClickHouse BYOC instead of having ClickHouse Cloud provision a new VPC, follow the steps below. This approach provides greater control over your network configuration and allows you to integrate ClickHouse BYOC into your existing network infrastructure.
 
@@ -37,10 +33,10 @@ If your VPC doesn't already have an S3 Gateway Endpoint configured, you'll need
 
 ### Ensure Network Connectivity {#ensure-network-connectivity}
 
-**Outbound Internet Access**  
+**Outbound Internet Access**
 Your VPC must permit at least outbound internet access so that ClickHouse BYOC components can communicate with the Tailscale control plane. Tailscale is used to provide secure, zero-trust networking for private management operations. Initial registration and setup with Tailscale require public internet connectivity, which can be achieved either directly or via a NAT gateway. This connectivity is required to maintain both the privacy and security of your BYOC deployment.
 
-**DNS Resolution**  
+**DNS Resolution**
 Ensure your VPC has working DNS resolution and doesn't block, interfere with, or overwrite standard DNS names. ClickHouse BYOC relies on DNS to resolve Tailscale control servers as well as ClickHouse service endpoints. If DNS is unavailable or misconfigured, BYOC services may fail to connect or operate properly.
 
 ### Configure your AWS account {#configure-aws-account}
@@ -65,7 +61,7 @@ After completing the above configuration steps, create a support ticket with the
 * The Private Subnet IDs you've allocated for ClickHouse
 * The availability zones these subnets are in
 
-Our team will review your configuration and complete the provisioning from our side. 
+Our team will review your configuration and complete the provisioning from our side.
 
 ## Customer-managed IAM roles {#customer-managed-iam-roles}
 

docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/02_customization/02_gcp.md

@@ -0,0 +1,43 @@
+---
+title: 'GCP Customized Setup'
+slug: /cloud/reference/byoc/onboarding/customization-gcp
+sidebar_label: 'GCP Customized Setup'
+keywords: ['BYOC', 'cloud', 'bring your own cloud', 'onboarding', 'GCP', 'VPC']
+description: 'Deploy ClickHouse BYOC into your existing GCP VPC'
+doc_type: 'reference'
+---
+
+import Image from '@theme/IdealImage';
+import byoc_gcp_subnet from '@site/static/images/cloud/reference/byoc-gcp-subnet.png';
+
+## Customer-managed VPC (BYO-VPC) for GCP {#customer-managed-vpc-gcp}
+
+If you prefer to use an existing VPC to deploy ClickHouse BYOC instead of having ClickHouse Cloud provision a new VPC, follow the steps below. This approach provides greater control over your network configuration and allows you to integrate ClickHouse BYOC into your existing network infrastructure.
+
+### Configure Your Existing VPC {#configure-existing-vpc}
+
+1. Allocate at least 1 private subnet in a [region supported by ClickHouse BYOC](/cloud/reference/byoc/supported-regions) for the ClickHouse Kubernetes (GKE) cluster. Ensure the subnet has a minimum CIDR range of `/24` (e.g., 10.0.0.0/24) to provide sufficient IP addresses for GKE cluster nodes.
+2. Within the private subnet, allocate at least 1 secondary IPv4 range that will be used for GKE cluster pods. The secondary range should be at least `/23` to provide sufficient IP addresses for GKE cluster pods.
+3. Enable **Private Google Access** on the subnet. This allows GKE nodes to reach Google APIs and services without requiring external IP addresses.
+
+<Image img={byoc_gcp_subnet} size="lg" alt="BYOC GCP Subnet details showing primary and secondary IPv4 ranges with Private Google Access enabled" />
+
+### Ensure Network Connectivity {#ensure-network-connectivity}
+
+**Cloud NAT Gateway**
+Ensure a [Cloud NAT gateway](https://cloud.google.com/nat/docs/overview) is deployed for the VPC. ClickHouse BYOC components require outbound internet access to communicate with the Tailscale control plane. Tailscale is used to provide secure, zero-trust networking for private management operations. The Cloud NAT gateway provides this outbound connectivity for instances without external IP addresses.
+
+**DNS Resolution**
+Ensure your VPC has working DNS resolution and doesn't block, interfere with, or overwrite standard DNS names. ClickHouse BYOC relies on DNS to resolve Tailscale control servers as well as ClickHouse service endpoints. If DNS is unavailable or misconfigured, BYOC services may fail to connect or operate properly.
+
+### Contact ClickHouse Support {#contact-clickhouse-support}
+
+After completing the above configuration steps, create a support ticket with the following information:
+
+* Your GCP project ID
+* The GCP region where you want to deploy the service
+* Your VPC network name
+* The subnet name you've allocated for ClickHouse
+* (Optional) The secondary IPv4 range names dedicated for ClickHouse. This is only required if the private subnet has multiple secondary IPv4 ranges and not all of them are intended for ClickHouse use
+
+Our team will review your configuration and complete the provisioning from our side.

docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/02_customization/_category_.json

@@ -0,0 +1,5 @@
+{
+  "label": "Customized Setup",
+  "collapsible": true,
+  "collapsed": true
+}

src/css/custom.scss

@@ -545,7 +545,11 @@ li.theme-doc-sidebar-item-category-level-1 {
 }
 
 .theme-doc-sidebar-item-category-level-6 {
-  padding-left: 2.2rem;
+  padding-left: 1.2rem;
+}
+
+.theme-doc-sidebar-item-link-level-7 {
+  padding-left: 1.2rem;
 }
 
 li.theme-doc-sidebar-item-category-level-2 > .menu__list {

vercel.json

@@ -46,6 +46,16 @@
       "destination": "/docs/cloud/manage/cloud-tiers",
       "permanent": true
     },
+    {
+      "source": "/docs/cloud/reference/byoc/onboarding/customization",
+      "destination": "/docs/cloud/reference/byoc/onboarding/customization-aws",
+      "permanent": true
+    },
+    {
+      "source": "/docs/en/cloud/reference/byoc/onboarding/customization",
+      "destination": "/docs/cloud/reference/byoc/onboarding/customization-aws",
+      "permanent": true
+    },
     {
       "source": "/docs/knowledgebase/why-clickhouse-is-so-fast",
       "destination": "/docs/concepts/why-clickhouse-is-so-fast",