Configure a VPC network

Google Cloud Managed Lustre instances are provisioned in a Google-managed network that connects to your Virtual Private Cloud (VPC) using private services access.

You can connect your Managed Lustre instance to client Compute Engine VMs or Google Kubernetes Engine clusters using either of the following network setups:

  • Same VPC network: Connect your client resources and your Managed Lustre instance to the same VPC network.

  • Separate VPC networks: Deploy your client resources in a separate VPC network and connect both networks using Network Connectivity Center. For instructions on setting up NCC, see the Network Connectivity Center documentation.

In both cases, the instructions on this page apply to the VPC network specified when creating the Managed Lustre instance. If you're connecting client resources in a separate VPC network, you only need to create a firewall rule in that network allowing traffic on ports 988 and 6988 from the allocated CIDR block.

Required permissions

You must have the following IAM permissions:

  • serviceusage.services.enable
  • compute.networks.create
  • compute.addresses.create
  • compute.addresses.get
  • compute.firewalls.create
  • servicenetworking.services.addPeering

These permissions can be granted by adding all of the following predefined roles:

Or, create a custom role containing the specific permissions.

To grant a role to a user:

Google Cloud console

  1. In the Google Cloud console, go to the IAM page.

    Go to IAM

  2. Click Grant access.

  3. In the New principals field, enter the user's email address.

  4. In the Select a role drop-down menu, select the role to grant.

  5. To grant multiple roles, click Add another role and select the next role.

  6. Click Save.

gcloud 

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="user:EMAIL_ADDRESS" \
  --role=ROLE

Create and peer the VPC

To create a VPC network and set up a private services access connection for Managed Lustre, perform the following steps:

Google Cloud console

  1. Enable the Service Networking API.

    Enable Service Networking API

  2. Create a VPC network in custom mode:

    1. In the Google Cloud console, go to the VPC networks page.

      Go to VPC networks

    2. Click Create VPC network.

    3. Enter a Name for the network.

    4. Unselect Set MTU automatically and enter 8896 in the Maximum transmission unit (MTU) field.

    5. Under Subnet creation mode, select Custom.

  3. Create a primary subnet for your GKE or Compute Engine resources:

    1. In the New subnet section, enter a Name for the subnet.
    2. Select a Region.
    3. In the IPv4 range field, enter the primary IPv4 range (for example, 10.128.0.0/20).
    4. Click Done.
    5. Click Create to create the VPC network.

  4. Allocate an IP range for private services access.

    This internal IP range is used for the private services access connection, which peers your VPC network with the Google-managed network where Managed Lustre resources are provisioned. This allocated range is used to provide IPs for Managed Lustre instances, and must not overlap with any subnets in your VPC network.

    Each Managed Lustre instance requires a contiguous CIDR block with a prefix length of at least 23.