In Cloudstack same VPC across different Projects

[amitmvyas]

Hi,

We have a requirement wherein I have tenant in which I have single VPC and multiple projects, I would like the have a different network in same VPC which is shared across different Projects.

I tried few things but didn't worked as expected, I would like to know whether anyone has tried similar thing or not ?

Regards,
Amit Vyas

[DaanHoogland]

@amitmvyas you could try by defining a shared network without connectivity.

[bernardodemarco]

Hello, @amitmvyas

ACS has the concept of domain VPCs, which allow sharing a VPC among multiple accounts and projects. For example, I have created a domain, with a domain administrator and two projects within it. With the domain administrator, I created a VPC:

Creation of the domain VPC

create vpc zoneid=cba042bd-f529-4531-a0c9-ff9c6f2bb507 vpcofferingid=acc69416-9ea2-443c-8105-2471ad20ee3e cidr=10.0.0.0/16 name="domainvpc"

Next, I created different tiers for different projects:

Creation of a tier for the project d1-project-1

create network name="tier-d1-project-1" networkofferingid=0b933c73-fd65-4e60-b85a-91a4bcf9eacc zoneid=cba042bd-f529-4531-a0c9-ff9c6f2bb507 vpcid=fe6f69ab-0df2-49d1-9b6b-13f6376ce741 projectid=0280c556-a790-4430-9d69-3fa5ba8cffa2 gateway=10.0.0.1 netmask=255.255.255.0

Creation of a tier for the project d1-project-2

create network name="tier-d1-project-2" networkofferingid=0b933c73-fd65-4e60-b85a-91a4bcf9eacc zoneid=cba042bd-f529-4531-a0c9-ff9c6f2bb507 vpcid=fe6f69ab-0df2-49d1-9b6b-13f6376ce741 projectid=55d2ee46-1939-46d3-ab20-01607de6a104 gateway=10.0.1.1 netmask=255.255.255.0

Now, a single VPC (domainvpc) is shared among different projects:

Tiers of the domain VPC

The same steps can be applied for accounts as well, enabling the sharing of the VPC with other accounts.

---

If your use case encompasses sharing a single tier among different projects, then it is not currently supported by ACS. A tier belong only to a single account or project.

However, it is possible to have shared networks with the Domain scope or isolated networks with network permissions.

---

Hope it helps :),
Bernardo De Marco Gonçalves

[weizhouapache]

@amitmvyas
can you please try with what @bernardodemarco relied ?