Adding note to use of Private Service Access module

GoogleCloudPlatform · Jan 11, 2025 · d49ff34 · d49ff34
1 parent ef16361
commit d49ff34
Show file tree

Hide file tree

Showing 17 changed files with 85 additions and 0 deletions.
diff --git a/community/examples/hpc-slurm-gromacs.yaml b/community/examples/hpc-slurm-gromacs.yaml
@@ -31,6 +31,11 @@ deployment_groups:
   - id: network
     source: modules/network/vpc
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/community/examples/hpc-slurm-local-ssd.yaml b/community/examples/hpc-slurm-local-ssd.yaml
@@ -31,6 +31,11 @@ deployment_groups:
   - id: network
     source: modules/network/vpc
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/community/examples/hpc-slurm-ubuntu2004.yaml b/community/examples/hpc-slurm-ubuntu2004.yaml
@@ -36,6 +36,11 @@ deployment_groups:
   - id: network
     source: modules/network/vpc
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/community/examples/htc-slurm.yaml b/community/examples/htc-slurm.yaml
@@ -45,6 +45,11 @@ deployment_groups:
   - id: network
     source: modules/network/vpc
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/community/modules/network/private-service-access/README.md b/community/modules/network/private-service-access/README.md
@@ -23,6 +23,11 @@ It will automatically perform the following steps, as described in the
   - source: modules/network/vpc
     id: network
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - source: community/modules/network/private-service-access
     id: ps_connect
     use: [network]

diff --git a/examples/gke-managed-parallelstore.yaml b/examples/gke-managed-parallelstore.yaml
@@ -38,6 +38,11 @@ deployment_groups:
         - range_name: services
           ip_cidr_range: 10.0.32.0/20
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access # required for parallelstore
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/examples/hcls-blueprint.yaml b/examples/hcls-blueprint.yaml
@@ -53,6 +53,11 @@ deployment_groups:
   - id: network
     source: modules/network/vpc
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/examples/hpc-enterprise-slurm.yaml b/examples/hpc-enterprise-slurm.yaml
@@ -51,6 +51,11 @@ deployment_groups:
   - id: network
     source: modules/network/vpc
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/examples/hpc-slurm.yaml b/examples/hpc-slurm.yaml
@@ -33,6 +33,11 @@ deployment_groups:
   - id: network
     source: modules/network/vpc
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/examples/machine-learning/a3-megagpu-8g/slurm-a3mega-base.yaml b/examples/machine-learning/a3-megagpu-8g/slurm-a3mega-base.yaml
@@ -40,6 +40,11 @@ deployment_groups:
     outputs:
     - network_name
     - subnetwork_name
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use:

diff --git a/examples/ml-slurm.yaml b/examples/ml-slurm.yaml
@@ -46,6 +46,11 @@ deployment_groups:
   - id: network
     source: modules/network/vpc
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/examples/pfs-parallelstore.yaml b/examples/pfs-parallelstore.yaml
@@ -31,6 +31,11 @@ deployment_groups:
   - id: network
     source: modules/network/vpc
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/examples/ps-slurm.yaml b/examples/ps-slurm.yaml
@@ -39,6 +39,11 @@ deployment_groups:
   - id: network
     source: modules/network/vpc
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/modules/file-system/gke-storage/README.md b/modules/file-system/gke-storage/README.md
@@ -15,6 +15,11 @@ then use them in a `gke-job-template` to dynamically provision the resource.
     settings:
       enable_parallelstore_csi: true
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/modules/file-system/parallelstore/README.md b/modules/file-system/parallelstore/README.md
@@ -40,6 +40,11 @@ for this newly created network.
  - id: network
     source: modules/network/vpc
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: private_service_access
     source: community/modules/network/private-service-access
     use: [network]

diff --git a/tools/validate_configs/test_configs/hpc-cluster-simple-nfs-sql.yaml b/tools/validate_configs/test_configs/hpc-cluster-simple-nfs-sql.yaml
@@ -28,6 +28,11 @@ deployment_groups:
   - id: network1
     source: modules/network/vpc
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - id: ps_connect
     source: community/modules/network/private-service-access
     use: [network1]

diff --git a/tools/validate_configs/test_configs/two-clusters-sql.yaml b/tools/validate_configs/test_configs/two-clusters-sql.yaml
@@ -50,6 +50,11 @@ deployment_groups:
   - source: modules/network/vpc
     id: hpc_network
 
+  # Private Service Access (PSA) requires the compute.networkAdmin role which is included in the Owner role, but not Editor
+  # PSA is a best practice for Filestore instances, but can be optionally
+  # removed by deleting the following 3 lines and any references to the module
+  # by Filestore modules. PSA is required for all Parallelstore functionality.
+  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
   - source: community/modules/network/private-service-access
     id: ps_connect
     use: [hpc_network]