Use a managed notebooks instance within a service perimeter

Use a managed notebooks instance within a service perimeter

Vertex AI Workbench managed notebooks is deprecated. On January 30, 2025, support for managed notebooks will end and the ability to create managed notebooks instances will be removed. Existing instances will continue to function but patches, updates, and upgrades won't be available. To continue using Vertex AI Workbench, we recommend that you migrate your managed notebooks instances to Vertex AI Workbench instances.

This page describes how to use VPC Service Controls to set up a managed notebooks instance within a service perimeter.

Before you begin

1. Read the Overview of VPC Service Controls.

2. Create a managed notebooks instance. This instance is not within a service perimeter yet.

3. Create a VPC network or use your project's default VPC network.

Create and configure the service perimeter

To create and configure the service perimeter, do the following:

1. Create a service perimeter using VPC Service Controls. This service perimeter protects the Google-managed resources of services that you specify. While creating your service perimeter, do the following:

   1. When it's time to add projects to your service perimeter, add the project that contains your managed notebooks instance.

   2. When it's time to add services to your service perimeter, add the Notebooks API.

If you have created your service perimeter without adding the projects and services you need, see Managing service perimeters to learn how to update your service perimeter.

Configure your DNS entries using Cloud DNS

Vertex AI Workbench managed notebooks instances use several domains that a Virtual Private Cloud network doesn't handle by default. To ensure that your VPC network correctly handles requests sent to those domains, use Cloud DNS to add DNS records. For more information about VPC routes, see Routes.

To create a managed zone for a domain, add a DNS entry that will route the request, and execute the transaction, complete the following steps. Repeat these steps for each of several domains that you need to handle requests for, starting with *.notebooks.googleapis.com.

In Cloud Shell or any environment where the Google Cloud CLI is installed, enter the following Google Cloud CLI commands.

1. To create a private managed zone for one of the domains that your VPC network needs to handle:

       gcloud dns managed-zones create ZONE_NAME \
           --visibility=private \
           --networks=https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/NETWORK_NAME \
           --dns-name=DNS_NAME \
           --description="Description of your managed zone"
       

   Replace the following:

   • ZONE_NAME: a name for the zone to create. You must use a separate zone for each domain. This zone name is used in each of the following steps.
   • PROJECT_ID: the ID of the project that hosts your VPC network
   • NETWORK_NAME: the name of the VPC network that you created earlier
   • DNS_NAME: the part of the domain name that comes after the *., with a period on the end. For example, *.notebooks.googleapis.com has a DNS_NAME of notebooks.googleapis.com.

2. Start a transaction.

       gcloud dns record-sets transaction start --zone=ZONE_NAME
       

3. Add the following DNS A record. This reroutes traffic to Google's restricted IP addresses.

       gcloud dns record-sets transaction add \
           --name=DNS_NAME. \
           --type=A 199.36.153.4 199.36.153.5 199.36.153.6 199.36.153.7 \
           --zone=ZONE_NAME \
           --ttl=300
       

4. Add the following DNS CNAME record to point to the A record that you just added. This redirects all traffic matching the domain to the IP addresses listed in the previous step.

       gcloud dns record-sets transaction add \
           --name=\*.DNS_NAME. \
           --type=CNAME DNS_NAME. \
           --zone=ZONE_NAME \
           --ttl=300
       

5. Execute the transaction.

       gcloud dns record-sets transaction execute --zone=ZONE_NAME
       

6. Repeat these steps for each of the following domains. For each repetition, change ZONE_NAME and DNS_NAME to the appropriate values for that domain. Keep PROJECT_ID and NETWORK_NAME the same each time. You already completed these steps for *.notebooks.googleapis.com.

   • *.notebooks.googleapis.com
   • *.notebooks.cloud.google.com
   • *.notebooks.googleusercontent.com
   • *.googleapis.com to run code that interacts with other Google APIs and services

Use Artifact Registry within your service perimeter

If you want to use Artifact Registry in your service perimeter, see Configure restricted access for GKE private clusters.

Use Shared VPC

If you are using Shared VPC, you must add the host and the service projects to the service perimeter. In the host project, you must also grant the Compute Network User role (roles/compute.networkUser) to the Notebooks Service Agent from the service project. For more information, see Managing service perimeters.

Access your managed notebooks instance

1. In the Google Cloud console, go to the Managed notebooks page.

   Go to Managed notebooks

2. Next to your managed notebooks instance's name, click Open JupyterLab.

3. If it's the first time you have accessed the managed notebooks instance's JupyterLab user interface, you must grant permission to access your data and authenticate your managed notebooks instance.

   1. In the Authenticate your managed notebook dialog, click the button to get an authentication code.

   2. Choose an account and click Allow. Copy the authentication code.

   3. In the Authenticate your managed notebook dialog, paste the authentication code, and then click Authenticate.

Your managed notebooks instance opens JupyterLab.

Limitations

Identity type for ingress and egress policies

When you specify an ingress or egress policy for a service perimeter, you can't use ANY_SERVICE_ACCOUNT or ANY_USER_ACCOUNT as an identity type for all Vertex AI Workbench operations.

Instead, use ANY_IDENTITY as the identity type.

Accessing the managed notebooks proxy from a workstation without internet

To access managed notebooks instances from a workstation with limited internet access, verify with your IT administrator that you can access the following domains:

• *.accounts.google.com
• *.accounts.youtube.com
• *.googleusercontent.com
• *.kernels.googleusercontent.com
• *.gstatic.com
• *.notebooks.cloud.google.com
• *.notebooks.googleapis.com

You must have access to these domains for authentication to Google Cloud. See the previous section, Configure your DNS entries using Cloud DNS, for further configuration information.

What's next

• Learn more about VPC Service Controls.