Configuring Networks
This page explains the networking modes available to all networks and how to configure networks according to CSP-specific parameters.
Networking Modes
ACTIVATE provides different networking modes for compute nodes on a cluster. The networking mode determines how compute nodes connect to the internet. Select a mode using the Provisioning mode field when creating a network. The mode cannot be changed after the network is created.
The same modes are available for AWS, Azure, Google Cloud, and Oracle Cloud accounts, although some modes are implemented differently depending on the CSP. See the CSP tabs below for details. OpenStack networks are managed by your OpenStack provider and do not use networking modes.
| Mode | Description | Tracks Egress Cost? | Notes |
|---|---|---|---|
| Centralized NAT | This networking mode will provision a NAT gateway. The NAT gateway will be used for outbound internet connectivity for all compute nodes in the region. | No | The NAT gateway will incur a charge for every hour it is running. |
| Controller NAT | All compute nodes will route their outbound internet traffic through the cluster's controller node, sharing a single outbound IP address. | Yes | Compute nodes depend on the controller for outbound internet connectivity. |
| Public IP | This networking mode will assign a public IP address to each compute node. The nodes' public IPs will not be accessible from the internet. | Yes | Each node will have its own IP address rather than having the same one as other nodes. |
| Private | This networking mode creates a fully private network with no direct internet access. | No | Outbound connectivity can optionally be provided by a NAT gateway, or by platform peering on AWS. |
The diagram below shows where outbound traffic from compute nodes leaves the network in each mode. In every mode, the controller's agent also needs an outbound route to the platform.
See the CSP tabs below for how each provider implements these modes.
In modes that track egress cost, outbound traffic originates from IP addresses that belong to the cluster's own nodes, so egress charges can be attributed to the cluster that generated them. In the other modes, egress traffic flows through a shared NAT gateway and is billed at the network level.
Private Mode Options
When you select the Private networking mode, up to two additional options appear, depending on the CSP:
- Peer to platform (AWS only): Connects the private network to the ACTIVATE platform through a Transit Gateway, allowing resources in the network to communicate with the platform. See the AWS tab below.
- Enable NAT gateway (AWS, Azure, and Google Cloud): On AWS, available when the network is not peered to the platform. When enabled, ACTIVATE provisions a NAT gateway that allows resources in the private network to make outbound internet connections (for example, downloading packages or accessing external APIs) while remaining unreachable from the internet.
Oracle Cloud offers neither option, so an Oracle Private network is always isolated.
Keep a route to the platform
The agent on each cluster's controller must reach the platform. A Private network that is neither peered to the platform nor has Enable NAT gateway selected has no outbound route, so clusters on it cannot connect unless you add your own route, such as a VPN or proxy.
When you choose such a network on the Add network form, ACTIVATE shows the warning "Clusters on this network can't connect to the platform." It doesn't stop you from creating the network. The warning also shows when you edit an existing AWS, Google Cloud, or Oracle network.
NAT Gateway Costs
In networking modes that provision a NAT gateway, the NAT gateway incurs a charge for every hour it is running. For more information, see your CSP's pricing documentation, for example the AWS pricing list.
CSP-Specific Configuration
Region
Select the Region that you want your network to be deployed in. For more information about Regions, see the AWS documentation.
CIDR Block
Enter a CIDR block for the network in the selected region. CIDR blocks must be valid and cannot overlap with other regions in the same network.
Networking Modes on AWS
- Centralized NAT provisions public and private subnets in each availability zone, with a single NAT gateway shared by all compute nodes in the region.
- Controller NAT places the controller and compute nodes in public subnets and points each compute node's default route at the controller, which forwards its outbound traffic. Partitions must be in the same availability zone as the controller; multi-zone partitions are not supported in this mode.
- Public IP places compute nodes in public subnets, each with its own public IP address.
- Private provisions private subnets only. Outbound connectivity is available through the optional NAT gateway or through Transit Gateway peering.
Transit Gateway Peering (Private Mode)
When using the Private networking mode on AWS, you can peer the network to the ACTIVATE platform via a Transit Gateway. If you enable peering, you must provide a Transit Gateway ID.
The Enable NAT gateway option is not available when using Transit Gateway peering, as traffic is expected to route through a central networking account.