[Yandex Cloud documentation](../../index.md) > [Yandex Virtual Private Cloud](../index.md) > [Tutorials](index.md) > Configuring network resources and interaction between them > Setting up networking between resources from different folders # Setting up networking between resources from different folders In Yandex Cloud, network resources, such as cloud network and subnets, are usually created in a single resource cloud folder that is not linked to resources in other cloud folders. When deploying resources in Yandex Cloud, it is often necessary to ensure networking between resources residing in different folders. One of the ways to do that is using the `Multi-folder VPC` method that extends the scope of an individual VPC network to multiple rather than one folder. Depending on the selected Yandex Cloud tools, you can extend your network scope to other folders by: * Moving subnets to other folders using the `management console (UI)` and `CLI`. * Creating subnets in target folders with `CLI`. * Creating subnets in target folders with `Terraform`. Once you placed a subnet into the target folder, you can connect other folder resources to it, including VMs, Managed Service for Kubernetes clusters, database hosts, load balancers, load testing agents, etc. As a result, you will have a network connecting resources from different folders. This guide provides an example of how to create an infrastructure consisting of three VM instances, each residing in a different folder. These instances are connected via a shared internal network. Network connectivity between cloud resources hosted in different folders is established by creating a cloud network in one of these folders and then extending its scope to other folders. This way, a single-folder network is extended to multiple folders, which allows connecting required resources to `extended subnets` residing in these folders. {% note warning %} You can only move subnets between folders within a single cloud. {% endnote %} In our example, we have a dev environment, including the CI/CD module with its components located in the `net-folder`. These components should be able to connect to other components located in **dev**, **stage**, and **prod** folders. You can see this configuration in the picture below. ![Multi-folder VPC](../../_assets/tutorials/infrastructure-management/multi-folder-vpc/multi-folder-vpc.svg) We are going to connect VMs residing in different subnets into one network. The VMs will be able to address each other by IP or FQDN addresses. ## Steps to follow {#order} Depending on the selected tools, steps to create `Multi-folder VPC` may differ. To create the test infrastructure and connect its resources: 1. [Get your cloud ready](#prepare-cloud). 1. [Create folders](#create-folders). 1. [Create a VPC cloud network with subnets](#create-vpc). 1. [Move the subnets](#move-subnets). 1. [Create VM instances](#create-vms). 1. [Check the connectivity](#check-connectivity). If you no longer need the resources you created, [delete them](#clear-out). ## Get your cloud ready {#prepare-cloud} Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md): 1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account. 1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it. If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud). [Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md). ### Required paid resources {#paid-resources} The infrastructure support costs include: * Fee for continuously running VMs (see [Yandex Compute Cloud pricing](../../compute/pricing.md)). * Fee for using public IP addresses and outgoing traffic (see [Yandex Virtual Private Cloud pricing](../pricing.md)). ### Configure access permissions {#roles} Configure [folder access permissions](../../resource-manager/operations/folder/set-access-bindings.md): * To create networks and manage subnets, assign the `vpc.admin` or the `vpc.privateAdmin`, `vpc.publicAdmin`, and `vpc.securityGroups.admin` roles to the service account or user. * To create and manage VMs, assign the `vpc.user` and `compute.admin` roles for the folder to the service account or user. For granular network access management, use [security groups](../concepts/security-groups.md). ## Create folders {#create-folders} 1. Create the `net-folder`, `dev-folder`, and `prod-folder` folders: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select a [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud) and click ![image](../../_assets/console-icons/ellipsis.svg) → ![Create icon](../../_assets/console-icons/plus.svg) **Create folder**. 1. Specify the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) name: `net-folder`. 1. Disable **Create a default network** to create your network and subnets manually. 1. Click **Create**. Similarly, create `dev-folder` and `prod-folder`. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install). {% note info %} To create resources with CLI, [get authenticated](../../cli/operations/authentication/service-account.md#auth-as-sa) under a [service account](../../iam/concepts/users/service-accounts.md) with the `admin` [role](../../iam/concepts/access-control/roles.md) for the [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud). {% endnote %} 1. Read the `create folder` command description: ```bash yc resource-manager folder create --help ``` 1. Create the `net-folder`, `dev-folder`, and `prod-folder` cloud folders: ```bash yc resource-manager folder create --name net-folder yc resource-manager folder create --name dev-folder yc resource-manager folder create --name prod-folder ``` - Terraform {#tf} 1. If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method. 1. Specify the Yandex Cloud Terraform provider configuration: ```hcl # ================================== # Terraform & Provider Configuration # ================================== terraform { required_providers { yandex = { source = "yandex-cloud/yandex" version = "~> 0.92.0" } } } ``` 1. Specify input variables: ```hcl variable "cloud_id" { description = "YC cloud-id. Taken from environment variable." } ``` 1. Specify your target cloud folders: ```hcl # ======== # Folders # ======== resource "yandex_resourcemanager_folder" "net_folder" { cloud_id = var.cloud_id name = "net-folder" } resource "yandex_resourcemanager_folder" "dev_folder" { cloud_id = var.cloud_id name = "dev-folder" } resource "yandex_resourcemanager_folder" "prod_folder" { cloud_id = var.cloud_id name = "prod-folder" } ``` 1. Create the required infrastructure: 1. Run the following commands: ```bash export TF_VAR_cloud_id=$(yc config get cloud-id) export YC_TOKEN=$(yc iam create-token) terraform apply ``` 1. When asked to confirm the changes, enter `yes` and wait for the operation to complete. - API {#api} Use the [create](../../resource-manager/api-ref/Folder/create.md) REST API method for the [Folder](../../resource-manager/api-ref/Folder/index.md) resource or the [FolderService/Create](../../resource-manager/api-ref/grpc/Folder/create.md) gRPC API call. {% endlist %} ## Create a VPC cloud network with subnets {#create-vpc} In `net-folder`, create the `shared-net` network and three subnets with the following settings: | Subnet name | Prefix | Availability zone | Target folder | | --- | --- | --- | --- | | `subnet-a` | `10.1.11.0/24` | `ru-central1-a` | `net-folder` | | `subnet-b` | `10.1.12.0/24` | `ru-central1-b` | `dev-folder` | | `subnet-d` | `10.1.13.0/24` | `ru-central1-d` | `prod-folder` | 1. Create a [cloud network](../concepts/network.md): {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), navigate to `net-folder`. 1. Navigate to **Virtual Private Cloud**. 1. Click **Create network**. 1. Specify the network name: `shared-net`. 1. Disable the [Create subnets](../operations/subnet-create.md) option to create subnets manually. 1. Click **Create network**. - CLI {#cli} 1. Read the description of the `network create` command: ```bash yc vpc network create --help ``` 1. Create the `shared-net` cloud network in `net-folder`. ```bash yc vpc network create --folder-name net-folder --name shared-net ``` - Terraform {#tf} 1. Specify your target network: ```hcl # ============= # VPC Resources # ============= resource "yandex_vpc_network" "shared_net" { folder_id = yandex_resourcemanager_folder.net_folder.id name = "shared-net" } ``` 1. Run the following commands: ```bash export TF_VAR_cloud_id=$(yc config get cloud-id) export YC_TOKEN=$(yc iam create-token) terraform apply ``` 1. Confirm updating the resources. 1. Wait for the operation to complete. - API {#api} Use the [create](../api-ref/Network/create.md) REST API method for the [Network](../api-ref/Network/index.md) resource or the [NetworkService/Create](../api-ref/grpc/Network/create.md) gRPC API call. {% endlist %} 1. Create [subnets](../concepts/network.md#subnet) named `subnet-a`, `subnet-b`, and `subnet-d` in the `ru-central1-a`, `ru-central1-b`, and `ru-central1-d` [availability zones](../../overview/concepts/geo-scope.md), respectively: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), navigate to `net-folder`. 1. Navigate to **Virtual Private Cloud**. 1. Click `shared-net`. 1. Click ![image](../../_assets/console-icons/nodes-right.svg) **Create subnet**. 1. Specify the subnet name: `subnet-a`, `subnet-b`, or `subnet-d`. 1. Select the availability zone from the drop-down list: `ru-central1-a`, `ru-central1-b`, or `ru-central1-d`, respectively. 1. Enter the subnet CIDR: IP address `10.1.11.0` and subnet mask `24`. For more information about IP address ranges, see [Cloud networks and subnets](../concepts/network.md). 1. Click **Create subnet**. - CLI {#cli} 1. Read the `subnet create` command description: ```bash yc vpc subnet create --help ``` 1. Create subnets in the target folders: ```bash yc vpc subnet create --folder-name net-folder --name subnet-a \ --network-name shared-net --zone ru-central1-a --range 10.1.11.0/24 yc vpc subnet create --folder-name dev-folder --name subnet-b \ --network-name shared-net --zone ru-central1-b --range 10.1.12.0/24 yc vpc subnet create --folder-name prod-folder --name subnet-d \ --network-name shared-net --zone ru-central1-d --range 10.1.13.0/24 ``` 1. Check the new subnet status: ```bash yc vpc subnet list --folder-name net-folder yc vpc subnet list --folder-name dev-folder yc vpc subnet list --folder-name prod-folder ``` - Terraform {#tf} 1. Specify your target subnets: ```hcl resource "yandex_vpc_subnet" "subnet_a" { folder_id = yandex_resourcemanager_folder.net_folder.id name = "subnet-a" description = "NET folder subnet" v4_cidr_blocks = ["10.1.11.0/24"] zone = "ru-central1-a" network_id = yandex_vpc_network.shared_net.id } resource "yandex_vpc_subnet" "subnet_b" { folder_id = yandex_resourcemanager_folder.dev_folder.id name = "subnet-b" description = "DEV folder subnet" v4_cidr_blocks = ["10.1.12.0/24"] zone = "ru-central1-b" network_id = yandex_vpc_network.shared_net.id } resource "yandex_vpc_subnet" "subnet_d" { folder_id = yandex_resourcemanager_folder.prod_folder.id name = "subnet-d" description = "PROD folder subnet" v4_cidr_blocks = ["10.1.13.0/24"] zone = "ru-central1-d" network_id = yandex_vpc_network.shared_net.id } ``` 1. Run the following commands: ```bash export TF_VAR_cloud_id=$(yc config get cloud-id) export YC_TOKEN=$(yc iam create-token) terraform apply ``` 1. When asked to confirm the changes, enter `yes` and wait for the operation to complete. - API {#api} Use the [create](../api-ref/Subnet/create.md) REST API method for the [Subnet](../api-ref/Subnet/index.md) resource or the [SubnetService/Create](../api-ref/grpc/Subnet/create.md) gRPC API call. {% endlist %} ## Move the subnets {#move-subnets} [Move](../operations/subnet-move.md) `subnet-b` to `dev-folder`: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), navigate to `net-folder`. 1. Navigate to **Virtual Private Cloud**. 1. Click `shared-net`. 1. Click ![image](../../_assets/console-icons/ellipsis.svg) next to `subnet-b` and select **Move**. 1. Select `dev-folder` from the drop-sown list. 1. Click **Move**. - CLI {#cli} 1. View the description of the CLI command to move subnets: ```bash yc vpc subnet move --help ``` 1. Move the subnet: ```bash yc vpc subnet move subnet-b \ --destination-folder-name dev-folder ``` - API {#api} Use the [move](../api-ref/Subnet/move.md) REST API method for the [Subnet](../api-ref/Subnet/index.md) resource or the [SubnetService/Move](../api-ref/grpc/Subnet/move.md) gRPC API call. {% endlist %} Similarly, move `subnet-d` to `prod-folder`: ## Create VMs {#create-vms} Create [VMs](../../compute/concepts/vm.md) with the following settings: | VM name | Folder | Availability zone | Subnet | | --- | --- | --- | --- | | `net-vm` | `net-folder` | `ru-central1-a` | `subnet-a` | | `dev-vm` | `dev-folder` | `ru-central1-b` | `subnet-b` | | `prod-vm` | `prod-folder` | `ru-central1-d` | `subnet-d` | {% list tabs group=instructions %} - Management console {#console} Create the Linux-based `net-vm` VM in `net-folder`: 1. In the [management console](https://console.yandex.cloud), select `net-folder`. 1. Click ![image](../../_assets/console-icons/plus.svg) **Create resource** and select ![image](../../_assets/console-icons/cpu.svg) **Virtual machine instance**. 1. Under **Boot disk image**, in the **Product search** field, enter `Ubuntu 22.04 LTS` and select a public [Ubuntu 22.04 LTS](https://yandex.cloud/en/marketplace/products/yc/ubuntu-22-04-lts) image. 1. Under **Location**, select the `ru-central1-a` [availability zone](../../overview/concepts/geo-scope.md). 1. Under **Network settings**: * In the **Subnet** field, select `subnet-a`. * In the **Public IP address** field, keep `Auto` to assign the VM a random external IP address from the Yandex Cloud pool or select a static address from the list if you reserved one. 1. Under **Access**, select **SSH key** and specify your VM access credentials: * In the **Login** field, specify the username: `ycuser`. * In the **SSH key** field, select the SSH key saved in your [organization user](../../organization/concepts/membership.md) profile. If there are no SSH keys in your profile or you want to add a new key: 1. Click **Add key**. 1. Enter a name for the SSH key. 1. Select one of the following: * `Enter manually`: Paste the contents of the public SSH key. You need to [create](../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own. * `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own. * `Generate key`: Automatically create an SSH key pair. When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home//.ssh` directory. In Windows, unpack the archive to the `C:\Users\/.ssh` directory. You do not need additionally enter the public key in the management console. 1. Click **Add**. The system will add the SSH key to your organization user profile. If the organization has [disabled](../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource. 1. Under **General information**, specify the VM name: `net-vm`. 1. Leave all other settings unchanged and click **Create VM**. Similarly, create `dev-vm` and `prod-vm` in the respective folders. {% note info %} When you create a VM, the system will assign it a public and private IP addresses Save them so you will be able to access the VM and test its connectivity. {% endnote %} - CLI {#cli} 1. Create the `vm-init.tpl` VM metadata template file: ```bash #cloud-config datasource: Ec2: strict_id: false ssh_pwauth: yes users: - name: "${USER_NAME}" sudo: ALL=(ALL) NOPASSWD:ALL shell: /bin/bash ssh_authorized_keys: - "${USER_SSH_KEY}" ``` 1. Generate a VM metadata file: ```bash export USER_NAME=ycuser export USER_SSH_KEY=$(cat ~/.ssh/id_rsa.pub) envsubst < vm-init.tpl > vm-config.txt ``` 1. Create VMs: ```bash yc compute instance create --name=net-vm --hostname=net-vm \ --zone=ru-central1-a \ --platform=standard-v3 \ --cores=2 --memory=4G --core-fraction=100 \ --create-boot-disk image-folder-id=standard-images,image-family=ubuntu-2204-lts \ --network-interface subnet-name=subnet-a,ipv4-address=auto,nat-ip-version=ipv4 \ --metadata-from-file user-data=vm-config.txt yc compute instance create --name=dev-vm --hostname=dev-vm \ --zone=ru-central1-b \ --platform=standard-v3 \ --cores=2 --memory=4G --core-fraction=100 \ --create-boot-disk image-folder-id=standard-images,image-family=ubuntu-2204-lts \ --network-interface subnet-name=subnet-b,ipv4-address=auto,nat-ip-version=ipv4 \ --metadata-from-file user-data=vm-config.txt yc compute instance create --name=prod-vm --hostname=prod-vm \ --zone=ru-central1-d \ --platform=standard-v3 \ --cores=2 --memory=4G --core-fraction=100 \ --create-boot-disk image-folder-id=standard-images,image-family=ubuntu-2204-lts \ --network-interface subnet-name=subnet-d,ipv4-address=auto,nat-ip-version=ipv4 \ --metadata-from-file user-data=vm-config.txt ``` {% note info %} The commands [`yc compute instance create`](../../cli/cli-ref/compute/cli-ref/instance/create.md) | [`create-with-container`](../../cli/cli-ref/compute/cli-ref/instance/create-with-container.md) | [`update`](../../cli/cli-ref/compute/cli-ref/instance/update.md) | [`add-metadata`](../../cli/cli-ref/compute/cli-ref/instance/add-metadata.md) support substitution of environment variable values into VM metadata. When you execute a Yandex Cloud CLI command, these values, specified in the `user-data` key in `$` format, will be substituted into the VM metadata from the environment variables of the environment the command is executed in. To change such behavior, i.e. to provide a variable name to the VM metadata in `$` format rather than take the variable value from the CLI command runtime environment, use the two-dollar syntax, e.g., `$$`. For more information, see [Specifics of providing environment variables in metadata via the CLI](../../compute/concepts/metadata/sending-metadata.md#environment-variables). {% endnote %} 1. Save the new VMs’ public IPs as you will need them later: ```bash NET_VM_IP=$(yc compute instance get net-vm --format=json | jq -r '.network_interfaces[0].primary_v4_address.one_to_one_nat.address') DEV_VM_IP=$(yc compute instance get dev-vm --format=json | jq -r '.network_interfaces[0].primary_v4_address.one_to_one_nat.address') PROD_VM_IP=$(yc compute instance get prod-vm --format=json | jq -r '.network_interfaces[0].primary_v4_address.one_to_one_nat.address') ``` - Terraform {#tf} 1. Specify input variables: ```hcl variable "user_name" { description = "VM User Name" default = "ycuser" } variable "user_ssh_key_path" { description = "User's SSH public key file" default = "~/.ssh/id_rsa.pub" } ``` 1. Create the `vm-init.tpl` VM metadata template file: ```hcl #cloud-config datasource: Ec2: strict_id: false ssh_pwauth: yes users: - name: "${USER_NAME}" sudo: ALL=(ALL) NOPASSWD:ALL shell: /bin/bash ssh_authorized_keys: - "${USER_SSH_KEY}" ``` 1. Describe your target VMs: ```hcl # ================= # Compute Resources # ================= data "yandex_compute_image" "vm_image" { family = "ubuntu-2204-lts" } resource "yandex_compute_disk" "boot-disk-1" { name = "boot-disk-1" type = "network-hdd" zone = "ru-central1-a" size = "20" image_id = yandex_compute_image.vm_image.id } resource "yandex_compute_disk" "boot-disk-2" { name = "boot-disk-2" type = "network-hdd" zone = "ru-central1-b" size = "20" image_id = yandex_compute_image.vm_image.id } resource "yandex_compute_disk" "boot-disk-3" { name = "boot-disk-3" type = "network-hdd" zone = "ru-central1-d" size = "20" image_id = yandex_compute_image.vm_image.id } resource "yandex_compute_instance" "net_vm" { folder_id = yandex_resourcemanager_folder.net_folder.id name = "net-vm" hostname = "net-vm" platform_id = "standard-v3" zone = "ru-central1-a" resources { cores = 2 memory = 4 } boot_disk { disk_id = yandex_compute_disk.boot-disk-1.id } network_interface { subnet_id = yandex_vpc_subnet.subnet_a.id nat = true } metadata = { user-data = templatefile("vm-init.tpl", { USER_NAME = var.user_name USER_SSH_KEY = file(var.user_ssh_key_path) }) } } resource "yandex_compute_instance" "dev_vm" { folder_id = yandex_resourcemanager_folder.dev_folder.id name = "dev-vm" hostname = "dev-vm" platform_id = "standard-v3" zone = "ru-central1-b" resources { cores = 2 memory = 4 } boot_disk { disk_id = yandex_compute_disk.boot-disk-2.id } network_interface { subnet_id = yandex_vpc_subnet.subnet_b.id nat = true } metadata = { user-data = templatefile("vm-init.tpl", { USER_NAME = var.user_name USER_SSH_KEY = file(var.user_ssh_key_path) }) } } resource "yandex_compute_instance" "prod_vm" { folder_id = yandex_resourcemanager_folder.prod_folder.id name = "prod-vm" hostname = "prod-vm" platform_id = "standard-v3" zone = "ru-central1-d" resources { cores = 2 memory = 4 } boot_disk { disk_id = yandex_compute_disk.boot-disk-3.id } network_interface { subnet_id = yandex_vpc_subnet.subnet_d.id nat = true } metadata = { user-data = templatefile("vm-init.tpl", { USER_NAME = var.user_name USER_SSH_KEY = file(var.user_ssh_key_path) }) } } # ======= # Outputs # ======= output "NET-vm" { value = yandex_compute_instance.network_vm.network_interface.0.nat_ip_address } output "DEV-vm" { value = yandex_compute_instance.dev_vm.network_interface.0.nat_ip_address } output "PROD-vm" { value = yandex_compute_instance.prod_vm.network_interface.0.nat_ip_address } ``` 1. Run the following commands: ```bash export TF_VAR_cloud_id=$(yc config get cloud-id) export YC_TOKEN=$(yc iam create-token) terraform apply ``` 1. When asked to confirm the changes, enter `yes` and wait for the operation to complete. - API {#api} To create a VM, use the [create](../../compute/api-ref/Instance/create.md) REST API method for the [Compute Instance](../../compute/api-ref/Instance/index.md) resource or the [InstanceService/Create](../../compute/api-ref/grpc/Instance/create.md) gRPC API call. {% endlist %} ## Check your resources connectivity {#check-connectivity} 1. Connect to the `net-vm` VM over SSH: ```bash ssh ycuser@ ``` 1. Check whether you can connect to `dev-vm`: ```bash ping -c3 ``` Result: ```text PING 10.127.20.4 (10.127.20.4) 56(84) bytes of data. 64 bytes from 10.127.20.4: icmp_seq=1 ttl=61 time=7.45 ms 64 bytes from 10.127.20.4: icmp_seq=2 ttl=61 time=5.61 ms 64 bytes from 10.127.20.4: icmp_seq=3 ttl=61 time=5.65 ms --- 10.127.20.4 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 5.613/6.235/7.446/0.855 ms ``` 1. Similarly, check the connection to `prod-vm`. 1. Connect to `dev-vm` over SSH and use **ping** to check the IP connectivity between `dev-vm`, `net-vm`, and `prod-vm`. 1. Connect to `prod-vm` over SSH and use **ping** to check the IP connectivity between `prod-vm`, `net-vm`, and `dev-vm`. ## How to delete the resources you created {#clear-out} To stop paying for the resources you created, [delete these VMs](../../compute/operations/vm-control/vm-delete.md): `net-vm`, `dev-vm`, and `prod-vm`.