Remove firewall rules from IRDMA VPCs

community/examples/hpc-slurm-h4d.yaml

@@ -41,18 +41,12 @@ deployment_groups:
       network_routing_mode: REGIONAL
       enable_cloud_router: false
       enable_cloud_nat: false
+      enable_internal_traffic: false
       subnetworks:
       - subnet_name: $(vars.deployment_name)-rdma-sub-0
         subnet_region: $(vars.region)
         subnet_ip: $(vars.rdma_net_range)
         region: $(vars.region)
-      firewall_rules:
-      - name: $(vars.deployment_name)-rdma-0
-        ranges: [$(vars.rdma_net_range)]
-        allow:
-        - protocol: tcp
-        - protocol: udp
-        - protocol: icmp
 
   - id: homefs
     source: modules/file-system/filestore
@@ -90,7 +84,6 @@ deployment_groups:
       machine_type: h4d-highmem-192-lssd
       node_count_static: 2
       node_count_dynamic_max: 0
-      enable_placement: false
       disk_type: hyperdisk-balanced
       on_host_maintenance: TERMINATE
       additional_networks:

examples/h4d-vm.yaml

@@ -46,18 +46,12 @@ deployment_groups:
       network_routing_mode: REGIONAL
       enable_cloud_router: false
       enable_cloud_nat: false
+      enable_internal_traffic: false
       subnetworks:
       - subnet_name: $(vars.deployment_name)-rdma-sub-0
         subnet_region: $(vars.region)
         subnet_ip: $(vars.rdma_net_range)
         region: $(vars.region)
-      firewall_rules:
-      - name: $(vars.deployment_name)-rdma-0
-        ranges: [$(vars.rdma_net_range)]
-        allow:
-        - protocol: tcp
-        - protocol: udp
-        - protocol: icmp
 
   - id: homefs
     source: modules/file-system/filestore

examples/machine-learning/a3-ultragpu-8g/a3ultra-slurm-blueprint.yaml

@@ -262,13 +262,6 @@ deployment_groups:
         count: 8
         ip_range: $(vars.rdma_net_range)
         region: $(vars.region)
-      firewall_rules:
-      - name: $(vars.deployment_name)-internal-rdma
-        ranges: [$(vars.rdma_net_range)]
-        allow:
-        - protocol: tcp
-        - protocol: udp
-        - protocol: icmp
 
   - id: homefs
     source: modules/file-system/filestore

examples/machine-learning/a3-ultragpu-8g/a3ultra-vm.yaml

@@ -81,13 +81,6 @@ deployment_groups:
         count: 8
         ip_range: $(vars.rdma_net_range)
         region: $(vars.region)
-      firewall_rules:
-      - name: $(vars.deployment_name)-internal-rdma
-        ranges: [$(vars.rdma_net_range)]
-        allow:
-        - protocol: tcp
-        - protocol: udp
-        - protocol: icmp
 
   - id: homefs
     source: modules/file-system/filestore

examples/machine-learning/a4-highgpu-8g/a4high-slurm-blueprint.yaml

@@ -224,13 +224,6 @@ deployment_groups:
         count: 8
         ip_range: $(vars.rdma_net_range)
         region: $(vars.region)
-      firewall_rules:
-      - name: $(vars.deployment_name)-internal-rdma
-        ranges: [$(vars.rdma_net_range)]
-        allow:
-        - protocol: tcp
-        - protocol: udp
-        - protocol: icmp
 
   - id: homefs
     source: modules/file-system/filestore

examples/machine-learning/a4-highgpu-8g/a4high-vm.yaml

@@ -88,13 +88,6 @@ deployment_groups:
         count: 8
         ip_range: $(vars.rdma_net_range)
         region: $(vars.region)
-      firewall_rules:
-      - name: $(vars.deployment_name)-internal-rdma
-        ranges: [$(vars.rdma_net_range)]
-        allow:
-        - protocol: tcp
-        - protocol: udp
-        - protocol: icmp
 
   - id: homefs
     source: modules/file-system/filestore

modules/network/gpu-rdma-vpc/README.md

@@ -115,7 +115,7 @@ No resources.
 |------|-------------|------|---------|:--------:|
 | <a name="input_delete_default_internet_gateway_routes"></a> [delete\_default\_internet\_gateway\_routes](#input\_delete\_default\_internet\_gateway\_routes) | If set, ensure that all routes within the network specified whose names begin with 'default-route' and with a next hop of 'default-internet-gateway' are deleted | `bool` | `false` | no |
 | <a name="input_deployment_name"></a> [deployment\_name](#input\_deployment\_name) | The name of the current deployment | `string` | n/a | yes |
-| <a name="input_enable_internal_traffic"></a> [enable\_internal\_traffic](#input\_enable\_internal\_traffic) | Enable a firewall rule to allow all internal TCP, UDP, and ICMP traffic within the network | `bool` | `true` | no |
+| <a name="input_enable_internal_traffic"></a> [enable\_internal\_traffic](#input\_enable\_internal\_traffic) | Enable a firewall rule to allow all internal TCP, UDP, and ICMP traffic within the network | `bool` | `false` | no |
 | <a name="input_firewall_log_config"></a> [firewall\_log\_config](#input\_firewall\_log\_config) | Firewall log configuration for Toolkit firewall rules (var.enable\_iap\_ssh\_ingress and others) | `string` | `"DISABLE_LOGGING"` | no |
 | <a name="input_firewall_rules"></a> [firewall\_rules](#input\_firewall\_rules) | List of firewall rules | `any` | `[]` | no |
 | <a name="input_mtu"></a> [mtu](#input\_mtu) | The network MTU (default: 8896). Recommended values: 0 (use Compute Engine default), 1460 (default outside HPC environments), 1500 (Internet default), or 8896 (for Jumbo packets). Allowed are all values in the range 1300 to 8896, inclusively. | `number` | `8896` | no |

modules/network/gpu-rdma-vpc/variables.tf

@@ -107,7 +107,7 @@ variable "delete_default_internet_gateway_routes" {
 variable "enable_internal_traffic" {
   type        = bool
   description = "Enable a firewall rule to allow all internal TCP, UDP, and ICMP traffic within the network"
-  default     = true
+  default     = false
 }
 
 variable "firewall_rules" {