{"id":2114,"date":"2026-01-28T02:37:46","date_gmt":"2026-01-28T10:37:46","guid":{"rendered":"https:\/\/wp.c9h.org\/cj\/?p=2114"},"modified":"2026-01-29T01:02:46","modified_gmt":"2026-01-29T09:02:46","slug":"dataproc-gpus-secure-boot-proxies","status":"publish","type":"post","link":"https:\/\/wp.c9h.org\/cj\/?p=2114","title":{"rendered":"Dataproc GPUs, Secure Boot, & Proxies"},"content":{"rendered":"Part
\n1: Building a Secure Network Foundation for Dataproc with GPUs &
\nSWP<\/h1>\n

Welcome to the first post in our series on running GPU-accelerated
\nDataproc workloads in secure, enterprise-grade environments. Many
\norganizations need to operate within VPCs that have no direct internet
\negress, instead routing all traffic through a Secure Web Proxy (SWP).
\nAdditionally, security mandates often require the use of Shielded VMs
\nwith Secure Boot enabled. This series will show you how to meet these
\nrequirements for your Dataproc GPU clusters.<\/p>\n

In this post, we\u2019ll focus on laying the network foundation using
\ntools from the LLC-Technologies-Collier\/cloud-dataproc<\/a>
\nrepository (branch proxy-sync-2026-01<\/code>).<\/p>\n

The Challenge: Network
\nIsolation & Control<\/h2>\n

Before we can even think about custom images or GPU drivers, we need
\na network environment that:<\/p>\n

    \n
  1. Prevents direct internet access from Dataproc cluster nodes.<\/li>\n
  2. Forces all egress traffic through a manageable and auditable
    \nSWP.<\/li>\n
  3. Provides the necessary connectivity for Dataproc to function and for
    \nus to build images later.<\/li>\n
  4. Supports Secure Boot for all VMs.<\/li>\n<\/ol>\n

    The Toolkit:
    \nLLC-Technologies-Collier\/cloud-dataproc<\/code><\/h2>\n

    To make setting up and tearing down these complex network
    \nenvironments repeatable and consistent, we\u2019ve developed a set of bash
    \nscripts within the gcloud<\/code> directory of the
    \ncloud-dataproc<\/code> repository. These scripts handle the
    \ncreation of VPCs, subnets, firewall rules, service accounts, and the
    \nSecure Web Proxy itself.<\/p>\n

    Key Script:
    \ngcloud\/bin\/create-dpgce-private<\/code><\/strong><\/p>\n

    This script is the cornerstone for creating the private, proxied
    \nenvironment. It automates:<\/p>\n