Configuring Networks
This page explains the networking modes available to all networks and how to configure networks according to CSP-specific parameters.
Networking Modes
ACTIVATE provides different networking modes for compute nodes on a cluster. The networking mode determines how compute nodes connect to the internet. Select a mode using the Provisioning Mode field when creating a network. The mode cannot be changed after the network is created.
The same modes are available for AWS, Azure, and Google Cloud accounts, although some modes are implemented differently depending on the CSP. See the CSP tabs below for details. OpenStack networks are managed by your OpenStack provider and do not use networking modes.
| Mode | Description | Tracks Egress Cost? | Notes |
|---|---|---|---|
| Centralized NAT | This networking mode will provision a NAT gateway. The NAT gateway will be used for outbound internet connectivity for all compute nodes in the region. | No | The NAT gateway will incur a charge for every hour it is running. |
| Controller NAT | All compute nodes will route their outbound internet traffic through the cluster's controller node, sharing a single outbound IP address. | Yes | Compute nodes depend on the controller for outbound internet connectivity. |
| Public IP | This networking mode will assign a public IP address to each compute node. The nodes' public IPs will not be accessible from the internet. | Yes | Each node will have its own IP address rather than having the same one as other nodes. |
| Private | This networking mode creates a fully private network with no direct internet access. | No | Outbound connectivity can optionally be provided by a NAT gateway or by platform peering. |
In modes that track egress cost, outbound traffic originates from IP addresses that belong to the cluster's own nodes, so egress charges can be attributed to the cluster that generated them. In the other modes, egress traffic flows through a shared NAT gateway and is billed at the network level.
Private Mode Options
When you select the Private networking mode, two additional options become available:
- Peer to Platform: Connects the private network to the ACTIVATE platform, allowing resources in the network to communicate with the platform. If disabled, the network is isolated. Peering is currently supported on AWS via a Transit Gateway; see the AWS tab below.
- Enable NAT Gateway: Available when the network is not peered to the platform. When enabled, ACTIVATE provisions a NAT gateway that allows resources in the private network to make outbound internet connections (for example, downloading packages or accessing external APIs) while remaining unreachable from the internet.
NAT Gateway Costs
In networking modes that provision a NAT gateway, the NAT gateway incurs a charge for every hour it is running. For more information, see your CSP's pricing documentation, for example the AWS pricing list.
CSP-Specific Configuration
Region
Select the Region that you want your network to be deployed in. For more information about Regions, see the AWS documentation.
CIDR Block
Enter a CIDR block for the network in the selected region. CIDR blocks must be valid and cannot overlap with other regions in the same network.
Networking Modes on AWS
- Centralized NAT provisions public and private subnets in each availability zone, with a single NAT gateway shared by all compute nodes in the region.
- Controller NAT requires partitions to be in the same availability zone as the controller. Multi-zone partitions are not supported in this mode.
- Public IP places compute nodes in public subnets, each with its own public IP address.
- Private provisions private subnets only. Outbound connectivity is available through the optional NAT gateway or through Transit Gateway peering.
Transit Gateway Peering (Private Mode)
When using the Private networking mode on AWS, you can peer the network to the ACTIVATE platform via a Transit Gateway. If you enable peering, you must provide a Transit Gateway ID.
The Enable NAT Gateway option is not available when using Transit Gateway peering, as traffic is expected to route through a central networking account.