VPC & Networking

An Amazon VPC is the network every other AWS resource lives in. ZopDay does not offer the VPC as its own item on the Provision screen. Instead, it builds one as the first step of a cluster, VM or datastore job when you choose Create new VPC. Through the ZopDay API you can also create a network-only job, with the resource type vpc.

Which subnets, gateways and route tables make up a new AWS VPC

For a new VPC, ZopDay creates:

• The VPC, with DNS hostnames turned on.
• One internet gateway, attached to the VPC.
• In each availability zone, a public /24 subnet and a private /24 subnet. These are carved in order from the start of the address range.
• One public route table with a 0.0.0.0/0 route to the internet gateway. Every public subnet uses it.
• In each availability zone, an Elastic IP and a NAT gateway in that zone’s public subnet. Each zone also gets a private route table with a 0.0.0.0/0 route to its NAT gateway.

Defaults: CIDR 10.0.0.0/16, 2 availability zones (the first available ones in the region).
Subnets with the defaults: 10.0.0.0/24 public and 10.0.1.0/24 private in the first zone,
10.0.2.0/24 public and 10.0.3.0/24 private in the second.
Tags: Name, provisioner=zopdev, and cluster-name set to the job name.

Can you set the AWS VPC range or zone count on the Provision screen

The Network section offers Create new VPC (the default) or Use existing VPC.

The number of zones is not on the Provision screen. You can set it if you create the job through the ZopDay API.

Advanced settings → Network shows an address range (CIDR) field. The Provision screen does not send it today, so a VPC created from the screen always uses 10.0.0.0/16. To use another range, create the job through the ZopDay API and give the range there.

What does ZopDay add to an existing AWS VPC

ZopDay reads the VPC’s subnets and route tables. It treats a subnet as public when its route table sends traffic to an internet gateway. Cluster jobs use the subnets as they are.

A VM job may need to add private subnets. This happens when the VPC has at least one public subnet but no private subnet. ZopDay then adds:

• Up to two private /24 subnets, one per zone that has a public subnet. They are carved from free space at the top of the address range.
• One Elastic IP and one NAT gateway.
• One route table.

All of these are tagged zop:managedBy=provisioner. Teardown removes only these additions.

Datastores in the VPC

A datastore job adds a DB subnet group and a security group, both named after the datastore. A datastore called orders gets the subnet group orders-db-sng and the security group orders-sg. The security group admits TCP 3306, 5432 and 6379 only from the VPC’s own address range.

Which AWS network features are left for you to add

ZopDay adds no VPC endpoints (gateway or interface) and no flow logs. It makes no network ACL changes and no Transit Gateway attachment.

There is no single-NAT option. A new VPC always gets one NAT gateway per zone.

Add any of these in AWS if your design needs them.

NAT gateways are the running cost

NAT gateways bill per hour and per GB processed, whether or not traffic flows. With the defaults, every new VPC carries 2 of them. Each extra zone adds another.

Traffic to S3 or DynamoDB can skip the NAT gateway through a gateway VPC endpoint. You add that endpoint yourself.

What happens to the AWS VPC when the job is deleted

If ZopDay created the VPC, deleting the job removes the VPC and everything listed above.

If you supplied the VPC, it stays in place. ZopDay removes only the subnets, NAT gateway and route table it added to it, if it added any.