Skip to content

Add optional NAT gateway for outbound connectivity to VNet script#54

Open
josecisneros04 wants to merge 1 commit into
mainfrom
improve-nat-gateway-vnet-script
Open

Add optional NAT gateway for outbound connectivity to VNet script#54
josecisneros04 wants to merge 1 commit into
mainfrom
improve-nat-gateway-vnet-script

Conversation

@josecisneros04

Copy link
Copy Markdown
Contributor

What

Extends workspace-setup/powershell-examples/managed-vnet-to-vnet-injection/create_databricks_vnet.ps1 with an optional NAT gateway step for outbound internet connectivity.

Changes

  • NAT gateway decision — the script now asks Create a NAT gateway for outbound internet connectivity? [y/n], or accepts -CreateNatGateway $true/$false to run unattended (uses [Nullable[bool]] so "omitted" can be distinguished from an explicit $false).
  • If yes — creates a Standard SKU static public IP, creates the NAT gateway, and associates it with both the public and private subnets (cluster nodes run in both under Secure Cluster Connectivity, so both need the outbound path).
  • If no — emits an alert that Azure default outbound access is retired and an explicit outbound method (NAT gateway, Azure Firewall/NVA + UDR, or Standard LB outbound rules) must be attached before launching clusters, with a link to the Microsoft doc.
  • New NatGatewayName / NatPublicIpName inputs are param-or-prompt with sensible defaults (<vnet>-nat, <vnet>-nat-pip).
  • New resources follow the existing idempotency checks (Test-AzCliResourceExists) and owner tagging conventions; added a Read-YesNo helper matching the existing prompt helpers.
  • Updated comment-based help (.DESCRIPTION, two .EXAMPLE blocks) and the final summary output.

The change is additive (+128/−1); existing parameter and prompt behavior is unchanged.

This pull request and its description were written by Isaac.

create_databricks_vnet.ps1 now prompts (or accepts -CreateNatGateway) for
whether a NAT gateway is needed for outbound internet access:

- If yes: creates a Standard SKU static public IP, creates the NAT gateway,
  and associates it with both the public and private subnets (cluster nodes
  run in both under Secure Cluster Connectivity).
- If no: emits an alert that Azure default outbound access is retired and an
  explicit outbound method must be attached before launching clusters.

All inputs remain usable as up-front parameters (non-interactive) or via
interactive prompts. NAT gateway/public IP names are param-or-prompt with
sensible defaults, and the new resources follow the existing idempotency and
owner-tagging patterns.

Co-authored-by: Isaac
@JoseDelgado9898
JoseDelgado9898 self-requested a review July 17, 2026 20:42

@JoseDelgado9898 JoseDelgado9898 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! I think we should have this version with the NAT Gateway on the main branch.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants