指定工作的網路

本文說明如何為執行工作的 VM 指定網路。

您可以指定具有所需存取權的網路，控管執行作業的 VM 連線。舉例來說，您可以指定網路，允許工作存取必要資源，或限制存取權以提升安全性。或者，如果您沒有任何網路需求，也不想為工作設定網路，請略過指定網路的步驟，改為使用預設網路設定。

如要進一步瞭解網路概念和設定網路的時機，請參閱 Batch 網路總覽。

事前準備

  1. 如果您從未使用過 Batch，請參閱「開始使用 Batch」，並完成專案和使用者的必要條件，啟用 Batch。

  2. 如要取得建立工作所需的權限，以便在特定網路上執行工作，請要求管理員授予下列 IAM 角色：

    如要進一步瞭解如何授予角色，請參閱「管理專案、資料夾和機構的存取權」。

    您或許還可透過自訂角色或其他預先定義的角色取得必要權限。

  3. 找出要用於這項工作的網路。為工作指定的網路必須符合下列規定： 詳情請參閱「建立及管理虛擬私有雲網路」。
  4. 如要讓作業在其他專案代管的共用虛擬私有雲網路子網路上執行，必須授予專案的 Batch 服務代理程式使用該子網路的權限。

    為確保專案的 Batch 服務代理程式具備必要權限，能建立在共用虛擬私有雲網路子網路上執行的工作，請要求管理員將共用虛擬私有雲子網路的 Compute Network User (roles/compute.networkUser) IAM 角色授予專案的 Batch 服務代理程式。

    詳情請參閱為服務帳戶設定共用虛擬私有雲的說明文件。

建立在特定網路上執行的工作

建立工作時，請指定工作使用的網路。 具體來說，您需要指定要執行這項工作的虛擬私有雲網路和子網路。

如要在建立這項工作時使用 VM 執行個體範本，請務必在 VM 執行個體範本中指定網路。否則，請按照下列步驟，使用 gcloud CLI 或 Batch API 為工作指定網路。

gcloud

如要使用 gcloud CLI 建立在特定網路上執行的工作，請選取下列其中一個選項：

使用 gcloud 標記指定工作網路

如要建立工作並使用 gcloud 旗標指定工作網路，請完成下列步驟：

  1. 建立 JSON 檔案，指定作業的設定詳細資料。

    舉例來說，如要建立基本指令碼作業，請建立包含下列內容的 JSON 檔案。

    {
  "taskGroups": [
    {
      "taskSpec": {
        "runnables": [
          {
            "script": {
              "text": "echo Hello world! This is task ${BATCH_TASK_INDEX}. This job has a total of ${BATCH_TASK_COUNT} tasks."
            }
          }
        ]
      },
      "taskCount": 3
    }
  ],
  "logsPolicy": {
    "destination": "CLOUD_LOGGING"
  }
}

  2. 使用 gcloud batch jobs submit 指令建立工作。 如要指定工作所屬的網路，請加入 --network 和 --subnetwork 標記。

    gcloud batch jobs submit JOB_NAME \
    --location LOCATION \
    --config JSON_CONFIGURATION_FILE \
    --network projects/HOST_PROJECT_ID/global/networks/NETWORK \
    --subnetwork projects/HOST_PROJECT_ID/regions/REGION/subnetworks/SUBNET

    更改下列內容：

    • JOB_NAME：這項工作的名稱。
    • LOCATION：這項工作的地點。
    • JSON_CONFIGURATION_FILE：JSON 檔案的路徑，內含作業的設定詳細資料。
    • HOST_PROJECT_ID：您指定網路的專案 ID：
      • 如果您使用共用 VPC 網路，請指定主專案。
      • 否則，請指定目前專案。
    • ：目前專案中的 VPC 網路名稱，或是由目前專案代管或與目前專案共用的共用 VPC 網路。NETWORK
    • REGION：子網路和作業 VM 所在的區域：
      • 如果您加入allowedLocations 欄位，指定工作 VM 的允許位置，則必須在此處指定相同區域。
      • 否則，地區必須與您為工作選取的位置 (LOCATION) 相同。
    • SUBNET：子網路的名稱，該子網路屬於虛擬私有雲網路，且與作業的 VM 位於相同區域。

使用 JSON 欄位指定作業的網路

如要建立工作，並使用 JSON 設定檔中的欄位指定工作網路，請完成下列步驟：

  1. 建立 JSON 檔案，指定作業的設定詳細資料。如要指定工作網路，請加入network 和 subnetwork 欄位。

    舉例來說，如要建立在特定網路上執行的基本指令碼工作，請建立含有下列內容的 JSON 檔案。

    {
  "taskGroups": [
    {
      "taskSpec": {
        "runnables": [
          {
            "script": {
              "text": "echo Hello world! This is task ${BATCH_TASK_INDEX}. This job has a total of ${BATCH_TASK_COUNT} tasks."
            }
          }
        ]
      },
      "taskCount": 3
    }
  ],
  "allocationPolicy": {
    "network": {
      "networkInterfaces": [
        {
          "network": "projects/HOST_PROJECT_ID/global/networks/NETWORK",
          "subnetwork": "projects/HOST_PROJECT_ID/regions/REGION/subnetworks/SUBNET"
        }
      ]
    }
  },
  "logsPolicy": {
    "destination": "CLOUD_LOGGING"
  }
}

    更改下列內容：

    • HOST_PROJECT_ID：您指定網路的專案 ID：
      • 如果您使用共用 VPC 網路，請指定主專案。
      • 否則，請指定目前專案。
    • ：目前專案中的 VPC 網路名稱，或是由目前專案代管或與目前專案共用的共用 VPC 網路。NETWORK
    • REGION：子網路和作業 VM 所在的區域：
      • 如果您加入allowedLocations 欄位，指定工作 VM 的允許位置，則必須在此處指定相同區域。
      • 否則，地區必須與您為工作選取的位置 (LOCATION) 相同。
    • SUBNET：子網路的名稱，該子網路屬於虛擬私有雲網路，且與作業的 VM 位於相同區域。

  2. 使用 gcloud batch jobs submit 指令建立工作。

    gcloud batch jobs submit JOB_NAME \
    --location LOCATION \
    --config JSON_CONFIGURATION_FILE

    更改下列內容：

    • JOB_NAME：這項工作的名稱。
    • LOCATION：這項工作的地點。
    • JSON_CONFIGURATION_FILE：JSON 檔案的路徑，內含作業的設定詳細資料。

Java


import com.google.cloud.batch.v1.AllocationPolicy;
import com.google.cloud.batch.v1.BatchServiceClient;
import com.google.cloud.batch.v1.CreateJobRequest;
import com.google.cloud.batch.v1.Job;
import com.google.cloud.batch.v1.LogsPolicy;
import com.google.cloud.batch.v1.LogsPolicy.Destination;
import com.google.cloud.batch.v1.Runnable;
import com.google.cloud.batch.v1.Runnable.Script;
import com.google.cloud.batch.v1.TaskGroup;
import com.google.cloud.batch.v1.TaskSpec;
import com.google.protobuf.Duration;
import java.io.IOException;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.TimeoutException;

public class CreateBatchCustomNetwork {

  public static void main(String[] args)
      throws IOException, ExecutionException, InterruptedException, TimeoutException {
    // TODO(developer): Replace these variables before running the sample.
    // Project ID or project number of the Google Cloud project you want to use.
    String projectId = "YOUR_PROJECT_ID";
    // Name of the region you want to use to run the job. Regions that are
    // available for Batch are listed on: https://cloud.google.com/batch/docs/get-started#locations
    String region = "europe-central2";
    // The name of the job that will be created.
    // It needs to be unique for each project and region pair.
    String jobName = "JOB_NAME";
    // The name of a VPC network in the current project or a Shared VPC network that is hosted by
    // or shared with the current project.

    String network = String.format("global/networks/%s", "test-network");
    // The name of a subnet that is part of the VPC network and is located
    // in the same region as the VMs for the job.
    String subnet = String.format("regions/%s/subnetworks/%s", region, "subnet");

    createBatchCustomNetwork(projectId, region, jobName, network, subnet);
  }

  // Create a job that runs on a specific network.
  public static Job createBatchCustomNetwork(String projectId, String region, String jobName,
                                             String network,  String subnet)
      throws IOException, ExecutionException, InterruptedException, TimeoutException {
    // Initialize client that will be used to send requests. This client only needs to be created
    // once, and can be reused for multiple requests.
    try (BatchServiceClient batchServiceClient = BatchServiceClient.create()) {
      // Define what will be done as part of the job.
      Runnable runnable =
          Runnable.newBuilder()
              .setScript(
                  Script.newBuilder()
                      .setText(
                          "echo Hello world! This is task ${BATCH_TASK_INDEX}. "
                              + "This job has a total of ${BATCH_TASK_COUNT} tasks.")
                      // You can also run a script from a file. Just remember, that needs to be a
                      // script that's already on the VM that will be running the job.
                      // Using setText() and setPath() is mutually exclusive.
                      // .setPath("/tmp/test.sh")
                      .build())
              .build();

      TaskSpec task = TaskSpec.newBuilder()
          // Jobs can be divided into tasks. In this case, we have only one task.
          .addRunnables(runnable)
          .setMaxRetryCount(2)
          .setMaxRunDuration(Duration.newBuilder().setSeconds(3600).build())
          .build();

      // Tasks are grouped inside a job using TaskGroups.
      // Currently, it's possible to have only one task group.
      TaskGroup taskGroup = TaskGroup.newBuilder()
          .setTaskCount(3)
          .setParallelism(1)
          .setTaskSpec(task)
          .build();

      // Specifies a VPC network and a subnet for Allocation Policy
      AllocationPolicy.NetworkPolicy networkPolicy =
          AllocationPolicy.NetworkPolicy.newBuilder()
              .addNetworkInterfaces(AllocationPolicy.NetworkInterface.newBuilder()
                  .setNetwork(network) // Set the network name
                  .setSubnetwork(subnet) // Set the subnet name
                  .setNoExternalIpAddress(true) // Blocks external access for all VMs
                  .build())
              .build();

      // Policies are used to define on what kind of virtual machines the tasks will run on.
      // In this case, we tell the system to use "e2-standard-4" machine type.
      // Read more about machine types here: https://cloud.google.com/compute/docs/machine-types
      AllocationPolicy.InstancePolicy instancePolicy =
          AllocationPolicy.InstancePolicy.newBuilder().setMachineType("e2-standard-4")
              .build();

      AllocationPolicy allocationPolicy =
          AllocationPolicy.newBuilder()
              .addInstances(AllocationPolicy.InstancePolicyOrTemplate.newBuilder()
              .setPolicy(instancePolicy).build())
              .setNetwork(networkPolicy)
              .build();

      Job job =
          Job.newBuilder()
              .addTaskGroups(taskGroup)
              .setAllocationPolicy(allocationPolicy)
              // We use Cloud Logging as it's an out of the box available option.
              .setLogsPolicy(
                  LogsPolicy.newBuilder().setDestination(Destination.CLOUD_LOGGING))
              .build();

      CreateJobRequest createJobRequest =
          CreateJobRequest.newBuilder()
              // The job's parent is the region in which the job will run for the specific project.
              .setParent(String.format("projects/%s/locations/%s", projectId, region))
              .setJob(job)
              .setJobId(jobName)
              .build();

      Job result =
          batchServiceClient
              .createJobCallable()
              .futureCall(createJobRequest)
              .get(5, TimeUnit.MINUTES);

      System.out.printf("Successfully created the job: %s", result.getName());

      return result;
    }
  }
}

Node.js

// Imports the Batch library
const batchLib = require('@google-cloud/batch');
const batch = batchLib.protos.google.cloud.batch.v1;

// Instantiates a client
const batchClient = new batchLib.v1.BatchServiceClient();

/**
 * TODO(developer): Update these variables before running the sample.
 */
// Project ID or project number of the Google Cloud project you want to use.
const projectId = await batchClient.getProjectId();
// Name of the region you want to use to run the job. Regions that are
// available for Batch are listed on: https://cloud.google.com/batch/docs/get-started#locations
const region = 'europe-central2';
// The name of the job that will be created.
// It needs to be unique for each project and region pair.
const jobName = 'example-job';
// The name of a VPC network in the current project or a Shared VPC network that is hosted by
// or shared with the current project.
const network = 'global/networks/test-network';
// The name of a subnetwork that is part of the VPC network and is located
// in the same region as the VMs for the job.
const subnetwork = `regions/${region}/subnetworks/subnet`;

// Define what will be done as part of the job.
const runnable = new batch.Runnable({
  script: new batch.Runnable.Script({
    commands: ['-c', 'echo Hello world! This is task ${BATCH_TASK_INDEX}.'],
  }),
});

// Specify what resources are requested by each task.
const computeResource = new batch.ComputeResource({
  // In milliseconds per cpu-second. This means the task requires 50% of a single CPUs.
  cpuMilli: 500,
  // In MiB.
  memoryMib: 16,
});

const task = new batch.TaskSpec({
  runnables: [runnable],
  computeResource,
  maxRetryCount: 2,
  maxRunDuration: {seconds: 3600},
});

// Tasks are grouped inside a job using TaskGroups.
const group = new batch.TaskGroup({
  taskCount: 3,
  taskSpec: task,
});

// Specify VPC network and a subnet for Allocation Policy
const networkPolicy = new batch.AllocationPolicy.NetworkPolicy({
  networkInterfaces: [
    new batch.AllocationPolicy.NetworkInterface({
      // Set the network name
      network,
      // Set the subnetwork name
      subnetwork,
      // Blocks external access for all VMs
      noExternalIpAddress: true,
    }),
  ],
});

// Policies are used to define on what kind of virtual machines the tasks will run on.
// In this case, we tell the system to use "e2-standard-4" machine type.
// Read more about machine types here: https://cloud.google.com/compute/docs/machine-types
const instancePolicy = new batch.AllocationPolicy.InstancePolicy({
  machineType: 'e2-standard-4',
});

const allocationPolicy = new batch.AllocationPolicy.InstancePolicyOrTemplate({
  policy: instancePolicy,
  network: networkPolicy,
});

const job = new batch.Job({
  name: jobName,
  taskGroups: [group],
  labels: {env: 'testing', type: 'script'},
  allocationPolicy,
  // We use Cloud Logging as it's an option available out of the box
  logsPolicy: new batch.LogsPolicy({
    destination: batch.LogsPolicy.Destination.CLOUD_LOGGING,
  }),
});

// The job's parent is the project and region in which the job will run
const parent = `projects/${projectId}/locations/${region}`;

async function callCreateBatchCustomNetwork() {
  // Construct request
  const request = {
    parent,
    jobId: jobName,
    job,
  };

  // Run request
  const [response] = await batchClient.createJob(request);
  console.log(JSON.stringify(response));
}

await callCreateBatchCustomNetwork();

Python

from google.cloud import batch_v1


def create_with_custom_network(
    project_id: str,
    region: str,
    network_name: str,
    subnet_name: str,
    job_name: str,
) -> batch_v1.Job:
    """Create a Batch job that runs on a specific network and subnet.

    Args:
        project_id: project ID or project number of the Cloud project you want to use.
        region: name of the region you want to use to run the job. Regions that are
            available for Batch are listed on: https://cloud.google.com/batch/docs/locations
        network_name: The name of a VPC network in the current project or a Shared VPC network.
        subnet_name: Name of the subnetwork to be used within the specified region.
        job_name: the name of the job that will be created.
            It needs to be unique for each project and region pair.
    Returns:
        A job object representing the job created.
    """

    client = batch_v1.BatchServiceClient()

    # Define what will be done as part of the job.
    runnable = batch_v1.Runnable()
    runnable.script = batch_v1.Runnable.Script()
    runnable.script.text = "echo Hello world! This is task ${BATCH_TASK_INDEX}. This job has a total of ${BATCH_TASK_COUNT} tasks."

    # Jobs can be divided into tasks. In this case, we have only one task.
    task = batch_v1.TaskSpec()
    task.runnables = [runnable]

    # We can specify what resources are requested by each task.
    resources = batch_v1.ComputeResource()
    resources.cpu_milli = 2000  # in milliseconds per cpu-second. This means the task requires 2 whole CPUs.
    resources.memory_mib = 16  # in MiB
    task.compute_resource = resources

    task.max_retry_count = 2
    task.max_run_duration = "3600s"

    # Tasks are grouped inside a job using TaskGroups.
    # Currently, it's possible to have only one task group.
    group = batch_v1.TaskGroup()
    group.task_count = 3
    group.task_spec = task

    # Policies are used to define on what kind of virtual machines the tasks will run on.
    # In this case, we tell the system to use "e2-standard-4" machine type.
    # Read more about machine types here: https://cloud.google.com/compute/docs/machine-types
    policy = batch_v1.AllocationPolicy.InstancePolicy()
    policy.machine_type = "e2-standard-4"
    instances = batch_v1.AllocationPolicy.InstancePolicyOrTemplate()
    instances.policy = policy
    allocation_policy = batch_v1.AllocationPolicy()
    allocation_policy.instances = [instances]

    # Create a NetworkInterface object to specify network settings for the job
    network_interface = batch_v1.AllocationPolicy.NetworkInterface()
    # Set the network to the specified network name within the project
    network_interface.network = f"projects/{project_id}/global/networks/{network_name}"
    # Set the subnetwork to the specified subnetwork within the region
    network_interface.subnetwork = (
        f"projects/{project_id}/regions/{region}/subnetworks/{subnet_name}"
    )
    allocation_policy.network.network_interfaces = [network_interface]

    job = batch_v1.Job()
    job.task_groups = [group]
    job.allocation_policy = allocation_policy
    # We use Cloud Logging as it's an out of the box available option
    job.logs_policy = batch_v1.LogsPolicy()
    job.logs_policy.destination = batch_v1.LogsPolicy.Destination.CLOUD_LOGGING

    create_request = batch_v1.CreateJobRequest()
    create_request.job = job
    create_request.job_id = job_name
    # The job's parent is the region in which the job will run
    create_request.parent = f"projects/{project_id}/locations/{region}"
    return client.create_job(create_request)

API

如要使用 Batch API 建立工作，請使用 jobs.create 方法，並指定工作設定詳細資料。如要指定工作網路，請加入network 和 subnetwork 欄位。

舉例來說，如要建立在特定網路上執行的基本指令碼工作，請提出以下 POST 要求：

POST https://batch.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/jobs?job_id=JOB_NAME

{
  "taskGroups": [
    {
      "taskSpec": {
        "runnables": [
          {
            "script": {
              "text": "echo Hello world! This is task ${BATCH_TASK_INDEX}. This job has a total of ${BATCH_TASK_COUNT} tasks."
            }
          }
        ]
      },
      "taskCount": 3
    }
  ],
  "allocationPolicy": {
    "network": {
      "networkInterfaces": [
        {
          "network": "projects/HOST_PROJECT_ID/global/networks/NETWORK",
          "subnetwork": "projects/HOST_PROJECT_ID/regions/REGION/subnetworks/SUBNET"
        }
      ]
    }
  },
  "logsPolicy": {
    "destination": "CLOUD_LOGGING"
  }
}

更改下列內容：

  • PROJECT_ID：專案的專案 ID。
  • LOCATION：這份工作的地點。
  • JOB_NAME：這項工作的名稱。
  • HOST_PROJECT_ID：您指定網路的專案 ID：
    • 如果您使用共用 VPC 網路，請指定主專案。
    • 否則，請指定目前專案 (PROJECT_ID)。
  • ：目前專案中的 VPC 網路名稱，或是由目前專案代管或與目前專案共用的共用 VPC 網路。NETWORK
  • REGION：子網路和作業 VM 所在的區域：
    • 如果您加入allowedLocations 欄位，指定工作 VM 的允許位置，則必須在此處指定相同區域。
    • 否則，地區必須與您為工作選取的位置 (LOCATION) 相同。
  • SUBNET：子網路的名稱，該子網路屬於虛擬私有雲網路，且與作業的 VM 位於相同區域。

後續步驟