Deploying within AWS VPC

[martinfleis]

We have a RDS Postgres database running within a VPC and would need to be able to access it from within the QHub/nebari infrastructure. I see the documentation on how to do that within Azure and GC but am not sure if the same is possible within AWS. Is that possible? Any idea how can I achieve that?

[dharhas]

@martinfleis sorry for the delay responding to this. I'll see if we can get you an answer next week. We haven't been great noticing discussion questions. We are trying to improve that.

[rsignell-usgs]

We also are very interested in this, as we wish to deploy Nebari on the USGS AWS account.
And to do that we need to use existing VPCs.

[cheryldmorse]

We are using Nebari for an IOOS project. We would like to be able to deploy to our existing VPCs in AWS but haven't been able to get that to work.

[pavithraes]

@rsignell-usgs @cheryldmorse - Thanks for supporting this discussion!

@viniciusdc @iameskild Could you please help confirm if this is possible? I'm happy to update the docs as per your comments. :)

[viniciusdc]

If I understood everything correctly, there are two requests here:

1. deploying nebari on an existing AWS VPC
2. deploying a third-party app into Nebari, allowing access to another VPC

(1) should automatically solve 2., as all apps would then be in the same VPC. The other way around would need more work.

So, for the first item, currently, Nebari accepts overwriting of the VPC/Networking for both Azure, and GCP (see old docs). The network configuration of Nebari VPC on AWS are defined here, so it is possible to implement an overriding mechanism to import an existing VPC resource to terraform. However, this would need to be scoped as an ENH issue/task.

(2) For this particular case of a DB access over VPCs... based on AWS docs, using a VPC peering seems to be the solution. I think Nebari might not be able to offer it as is during deployment due to its specificness, but we could add some toggle switch in the yaml to deploy such a Link. For a general third-party tool, we could deploy a standalone app using the nebari helm-extension mechanism and allow it IP to use the VPC tunnel.

All of the above would be wonderful enchantments to the user customization capabilities in the nebari config, and require each a separate ENH issue to track 😄

[pavithraes]

Thank you for taking a look, Vini! I've created #1597 to track this, and shall note to update the docs to mention that AWS is currently not supported. :)