Connect a TPU to a Shared VPC network

Important: This guide explains how to set up Cloud TPUs that use a centrally managed Shared VPC network. This document assumes you are familiar with VPCs and have created a Shared VPC. For more information on how to create and manage Shared VPC networks, see Create and modify Shared VPC networks.

Configure a VPC host project

You need to grant the TPU Service Account in your service project permissions to manage resources in the host project. You do this using the "TPU Shared VPC Agent" (roles/tpu.xpnAgent) role. Run the following gcloud commands to grant this role binding.

gcloud projects add-iam-policy-binding host-project-id \
--member=serviceAccount:[e-mail] \
--role=roles/tpu.xpnAgent

Note: You can find your service project number in the project info section of the Google Cloud console dashboard.

Create a TPU VM connected to a Shared VPC Network

First determine which accelerator types and versions are available in the zone

gcloud compute tpus accelerator-types list --zone zone

gcloud compute tpus versions list --zone zone

You connect a TPU VM to a Shared VPC network when you create your TPU. Specify your Shared VPC using the --network tag:

gcloud compute tpus tpu-vm create tpu-name \
   --zone zone \
   --accelerator-type accelerator-type \
   --network projects/host-project-id/global/networks/host-network \
   --version tpu-image-version \
   --project your-service-project-id

Note: The --network tag must be set to the fully qualified network name. For example, projects/my-host-project-id/global/networks/my-network.

You can verify your TPU VM is connected to your Shared VPC using the gcloud describe command:

$ gcloud compute tpus tpu-vm describe tpu-name --zone zone

The response includes the network to which your TPU VM is attached:

acceleratorType: v3-8
apiVersion: V2
cidrBlock: 10.128.0.0/20
createTime: '2022-06-17T21:32:13.859274143Z'
health: HEALTHY
id: '0000000000000000000'
name: projects/my-project/locations/us-central1-b/nodes/my-tpu
networkConfig:
  enableExternalIps: true
  network: projects/my-project/global/networks/default
  subnetwork: projects/my-project/regions/us-central1/subnetworks/default
networkEndpoints:
- accessConfig:
    externalIp: 000.000.000.000
  ipAddress: 10.128.0.104
  port: 8470
runtimeVersion: tpu-vm-tf-2.8.0
schedulingConfig: {}
serviceAccount:
  email: [e-mail]
  scope:
  - https://www.googleapis.com/auth/devstorage.read_write
  - https://www.googleapis.com/auth/logging.write
  - https://www.googleapis.com/auth/service.management
  - https://www.googleapis.com/auth/servicecontrol
  - https://www.googleapis.com/auth/cloud-platform
  - https://www.googleapis.com/auth/pubsub
shieldedInstanceConfig: {}
state: READY

Delete the TPU VM

When you are done with the TPU VM, make sure to delete it.

gcloud compute tpus tpu-vm delete tpu-name --zone zone