Compress the H4D blueprint with multivpc and vpc module update (#5133)

Author: SwarnaBharathiMantena

examples/gke-h4d/gke-h4d.yaml

@@ -56,17 +56,17 @@ deployment_groups:
       subnetworks:
       - subnet_name: $(vars.deployment_name)-sub
         subnet_region: $(vars.region)
-        subnet_ip: 192.168.0.0/24
+        subnet_ip: 10.10.0.0/20
       secondary_ranges_list:
       - subnetwork_name: $(vars.deployment_name)-sub
         ranges:
         - range_name: pods
-          ip_cidr_range: 10.64.0.0/19
+          ip_cidr_range: 10.11.0.0/16
         - range_name: services
-          ip_cidr_range: 10.65.0.0/19
+          ip_cidr_range: 10.10.16.0/20
       firewall_rules:
       - name: $(vars.deployment_name)-internal
-        ranges: [192.168.0.0/24]
+        ranges: ["10.10.0.0/15"]
         allow:
         - protocol: tcp
           ports: ["0-65535"]
@@ -75,18 +75,19 @@ deployment_groups:
         - protocol: icmp
 
   - id: gke-h4d-rdma-net
-    source: modules/network/vpc
+    source: modules/network/multivpc
     settings:
-      network_name: $(vars.deployment_name)-rdma-net
+      network_name_prefix: $(vars.deployment_name)-rdma-net
       network_profile: https://www.googleapis.com/compute/beta/projects/$(vars.project_id)/global/networkProfiles/$(vars.zone)-vpc-falcon
-      network_routing_mode: REGIONAL
+      network_routing_mode: "REGIONAL"
+      network_count: 1
       enable_cloud_router: false
       enable_cloud_nat: false
-      subnetworks:
-      - subnet_name: $(vars.deployment_name)-rdma-sub
-        subnet_region: $(vars.region)
-        subnet_ip: 192.168.1.0/24
-        region: $(vars.region)
+      global_ip_address_range: 10.20.0.0/16
+      subnetwork_cidr_suffix: 24
+      subnetwork_private_access: false
+      network_interface_defaults:
+        nic_type: "IRDMA"
 
   - id: node_pool_service_account
     source: modules/project/service-account
@@ -114,7 +115,7 @@ deployment_groups:
 
   - id: h4d-cluster
     source: modules/scheduler/gke-cluster
-    use: [gke-h4d-net, workload_service_account]
+    use: [gke-h4d-net, gke-h4d-rdma-net, workload_service_account]
     settings:
       system_node_pool_machine_type: "e2-standard-16"
       system_node_pool_disk_size_gb: $(vars.system_node_pool_disk_size_gb)
@@ -127,21 +128,6 @@ deployment_groups:
       master_authorized_networks:
       - cidr_block: $(vars.authorized_cidr) # Allows your machine to run the kubectl command. Required for multi network setup.
         display_name: "kubectl-access-network"
-      additional_networks:
-        $(concat(
-          [{
-            network=gke-h4d-rdma-net.network_name,
-            subnetwork=gke-h4d-rdma-net.subnetwork_name,
-            subnetwork_project=vars.project_id,
-            nic_type="IRDMA",
-            queue_count=null,
-            network_ip=null,
-            stack_type=null,
-            access_config=[{nat_ip=null, public_ptr_domain_name=null, network_tier=null}],
-            ipv6_access_config=[],
-            alias_ip_range=[]
-          }]
-        ))
       # Cluster versions cannot be updated through the toolkit after creation
       # Please manage cluster version from the Google Cloud Console directly
       version_prefix: "1.32."
@@ -155,7 +141,7 @@ deployment_groups:
 
   - id: h4d-pool
     source: modules/compute/gke-node-pool
-    use: [h4d-cluster, node_pool_service_account]
+    use: [h4d-cluster, gke-h4d-rdma-net, node_pool_service_account]
     settings:
       machine_type: h4d-highmem-192-lssd
       auto_upgrade: true
@@ -183,21 +169,6 @@ deployment_groups:
         effect: NO_SCHEDULE
       placement_policy:
         type: COMPACT
-      additional_networks:
-        $(concat(
-          [{
-            network=gke-h4d-rdma-net.network_name,
-            subnetwork=gke-h4d-rdma-net.subnetwork_name,
-            subnetwork_project=vars.project_id,
-            nic_type="IRDMA",
-            queue_count=null,
-            network_ip=null,
-            stack_type=null,
-            access_config=[{nat_ip=null, public_ptr_domain_name=null, network_tier=null}],
-            ipv6_access_config=[],
-            alias_ip_range=[]
-          }]
-        ))
     outputs: [instructions]
 
   # Install Kueue and Jobset

modules/network/multivpc/README.md

@@ -103,6 +103,8 @@ limitations under the License.
 | <a name="input_allowed_ssh_ip_ranges"></a> [allowed\_ssh\_ip\_ranges](#input\_allowed\_ssh\_ip\_ranges) | A list of CIDR IP ranges from which to allow ssh access | `list(string)` | `[]` | no |
 | <a name="input_delete_default_internet_gateway_routes"></a> [delete\_default\_internet\_gateway\_routes](#input\_delete\_default\_internet\_gateway\_routes) | If set, ensure that all routes within the network specified whose names begin with 'default-route' and with a next hop of 'default-internet-gateway' are deleted | `bool` | `false` | no |
 | <a name="input_deployment_name"></a> [deployment\_name](#input\_deployment\_name) | The name of the current deployment | `string` | n/a | yes |
+| <a name="input_enable_cloud_nat"></a> [enable\_cloud\_nat](#input\_enable\_cloud\_nat) | Enable the creation of Cloud NATs. | `bool` | `true` | no |
+| <a name="input_enable_cloud_router"></a> [enable\_cloud\_router](#input\_enable\_cloud\_router) | Enable the creation of a Cloud Router for your VPC. For more information on Cloud Routers see https://cloud.google.com/network-connectivity/docs/router/concepts/overview | `bool` | `true` | no |
 | <a name="input_enable_iap_rdp_ingress"></a> [enable\_iap\_rdp\_ingress](#input\_enable\_iap\_rdp\_ingress) | Enable a firewall rule to allow Windows Remote Desktop Protocol access using IAP tunnels | `bool` | `false` | no |
 | <a name="input_enable_iap_ssh_ingress"></a> [enable\_iap\_ssh\_ingress](#input\_enable\_iap\_ssh\_ingress) | Enable a firewall rule to allow SSH access using IAP tunnels | `bool` | `true` | no |
 | <a name="input_enable_iap_winrm_ingress"></a> [enable\_iap\_winrm\_ingress](#input\_enable\_iap\_winrm\_ingress) | Enable a firewall rule to allow Windows Remote Management (WinRM) access using IAP tunnels | `bool` | `false` | no |
@@ -121,6 +123,7 @@ limitations under the License.
 | <a name="input_project_id"></a> [project\_id](#input\_project\_id) | Project in which the HPC deployment will be created | `string` | n/a | yes |
 | <a name="input_region"></a> [region](#input\_region) | The default region for Cloud resources | `string` | n/a | yes |
 | <a name="input_subnetwork_cidr_suffix"></a> [subnetwork\_cidr\_suffix](#input\_subnetwork\_cidr\_suffix) | The size, in CIDR suffix notation, for each network (e.g. 24 for 172.16.0.0/24); changing this will destroy every network. | `number` | `16` | no |
+| <a name="input_subnetwork_private_access"></a> [subnetwork\_private\_access](#input\_subnetwork\_private\_access) | Enable Private Google Access on the subnetworks | `bool` | `true` | no |
 
 ## Outputs
 

modules/network/multivpc/main.tf

@@ -75,4 +75,7 @@ module "vpcs" {
   network_description                    = var.network_description
   network_routing_mode                   = var.network_routing_mode
   network_profile                        = var.network_profile
+  enable_cloud_router                    = var.enable_cloud_router
+  enable_cloud_nat                       = var.enable_cloud_nat
+  subnetwork_private_access              = var.subnetwork_private_access
 }

modules/network/multivpc/variables.tf

@@ -40,10 +40,6 @@ variable "network_count" {
   type        = number
   default     = 4
 
-  validation {
-    condition     = var.network_count > 1
-    error_message = "The minimum VPCs able to be created by this module is 2. Use the standard Toolkit module at modules/network/vpc for count = 1"
-  }
   validation {
     condition     = var.network_count <= 8
     error_message = "The maximum VPCs able to be created by this module is 8"
@@ -199,3 +195,21 @@ variable "network_profile" {
   EOT
   default     = null
 }
+
+variable "enable_cloud_router" {
+  type        = bool
+  description = "Enable the creation of a Cloud Router for your VPC. For more information on Cloud Routers see https://cloud.google.com/network-connectivity/docs/router/concepts/overview"
+  default     = true
+}
+
+variable "enable_cloud_nat" {
+  type        = bool
+  description = "Enable the creation of Cloud NATs."
+  default     = true
+}
+
+variable "subnetwork_private_access" {
+  type        = bool
+  description = "Enable Private Google Access on the subnetworks"
+  default     = true
+}

modules/network/vpc/README.md

@@ -220,6 +220,7 @@ limitations under the License.
 | <a name="input_secondary_ranges_list"></a> [secondary\_ranges\_list](#input\_secondary\_ranges\_list) | "List of secondary ranges associated with the subnetworks.<br/>Each subnetwork must be specified at most once in this list." | <pre>list(object({<br/>    subnetwork_name = string,<br/>    ranges = list(object({<br/>      range_name    = string,<br/>      ip_cidr_range = string<br/>    }))<br/>  }))</pre> | `[]` | no |
 | <a name="input_shared_vpc_host"></a> [shared\_vpc\_host](#input\_shared\_vpc\_host) | Makes this project a Shared VPC host if 'true' (default 'false') | `bool` | `false` | no |
 | <a name="input_subnetwork_name"></a> [subnetwork\_name](#input\_subnetwork\_name) | The name of the network to be created (if unsupplied, will default to "{deployment\_name}-primary-subnet") | `string` | `null` | no |
+| <a name="input_subnetwork_private_access"></a> [subnetwork\_private\_access](#input\_subnetwork\_private\_access) | Enable Private Google Access on the subnetworks | `bool` | `true` | no |
 | <a name="input_subnetwork_size"></a> [subnetwork\_size](#input\_subnetwork\_size) | DEPRECATED: please see https://goo.gle/hpc-toolkit-vpc-deprecation for migration instructions | `number` | `null` | no |
 | <a name="input_subnetworks"></a> [subnetworks](#input\_subnetworks) | List of subnetworks to create within the VPC. If left empty, it will be<br/>replaced by a single, default subnetwork constructed from other parameters<br/>(e.g. var.region). In all cases, the first subnetwork in the list is identified<br/>by outputs as a "primary" subnetwork.<br/><br/>subnet\_name           (string, required, name of subnet)<br/>subnet\_region         (string, required, region of subnet)<br/>subnet\_ip             (string, mutually exclusive with new\_bits, CIDR-formatted IP range for subnetwork)<br/>new\_bits              (number, mutually exclusive with subnet\_ip, CIDR bits used to calculate subnetwork range)<br/>subnet\_private\_access (bool, optional, Enable Private Access on subnetwork)<br/>subnet\_flow\_logs      (map(string), optional, Configure Flow Logs see terraform-google-network module)<br/>description           (string, optional, Description of Network)<br/>purpose               (string, optional, related to Load Balancing)<br/>role                  (string, optional, related to Load Balancing) | `list(map(string))` | `[]` | no |
 

modules/network/vpc/main.tf

@@ -40,7 +40,7 @@ locals {
     subnet_name           = local.subnetwork_name
     subnet_ip             = local.default_primary_subnetwork_cidr_block
     subnet_region         = var.region
-    subnet_private_access = true
+    subnet_private_access = var.subnetwork_private_access
     subnet_flow_logs      = false
     description           = "primary subnetwork in ${local.network_name}"
     purpose               = null

modules/network/vpc/variables.tf

@@ -311,3 +311,9 @@ variable "network_profile" {
   EOT
   default     = null
 }
+
+variable "subnetwork_private_access" {
+  type        = bool
+  description = "Enable Private Google Access on the subnetworks"
+  default     = true
+}

tools/cloud-build/daily-tests/builds/gke-h4d.yaml

@@ -19,6 +19,7 @@ tags:
 - m.gke-node-pool
 - m.service-account
 - m.vpc
+- m.multivpc
 - m.kubectl-apply
 - m.filestore
 - m.gke-job-template