gclouddnsmanaged-zonescreateZONE_NAME\--visibility=private\--networks=https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/NETWORK_NAME\--dns-name=DNS_NAME\--description="Description of your managed zone"
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2024-11-25。"],[],[],null,["# Use a managed notebooks instance within a service perimeter\n===========================================================\n\n\n| Vertex AI Workbench managed notebooks is\n| [deprecated](/vertex-ai/docs/deprecations). On\n| April 14, 2025, support for\n| managed notebooks will end and the ability to create managed notebooks instances\n| will be removed. Existing instances will continue to function\n| but patches, updates, and upgrades won't be available. To continue using\n| Vertex AI Workbench, we recommend that you\n| [migrate\n| your managed notebooks instances to Vertex AI Workbench instances](/vertex-ai/docs/workbench/managed/migrate-to-instances).\n\n\u003cbr /\u003e\n\nThis page describes how to use VPC Service Controls to set up\na managed notebooks instance within a service perimeter.\n\nBefore you begin\n----------------\n\n1. Read the [Overview of\n VPC Service Controls](/vpc-service-controls/docs/overview).\n\n2. [Create a managed notebooks\n instance](/vertex-ai/docs/workbench/managed/create-instance).\n This instance is not within a service\n perimeter yet.\n\n3. [Create a VPC network](/vpc/docs/create-modify-vpc-networks)\n or use your project's\n [default VPC network](/vpc/docs/vpc#default-network).\n\nCreate and configure the service perimeter\n------------------------------------------\n\nTo create and configure the service perimeter, do the following:\n\n1. [Create a service perimeter using\n VPC Service Controls](/vpc-service-controls/docs/create-service-perimeters).\n This service perimeter protects the Google-managed resources of services\n that you specify. While creating your service perimeter, do the following:\n\n 1. When it's time to add projects to your service perimeter, add the\n project that contains your managed notebooks instance.\n\n 2. When it's time to add services to your service perimeter, add the\n **Notebooks API**.\n\nIf you have created your service perimeter without adding the\nprojects and services you need, see [Managing service\nperimeters](/vpc-service-controls/docs/manage-service-perimeters)\nto learn how to update your service perimeter.\n\nConfigure your DNS entries using Cloud DNS\n------------------------------------------\n\n\nVertex AI Workbench managed notebooks instances use several domains that a\nVirtual Private Cloud network doesn't handle by default.\nTo ensure that your VPC network correctly handles requests sent\nto those domains, use Cloud DNS to add DNS records. For more\ninformation about VPC routes, see [Routes](/vpc/docs/routes).\n\n\nTo create a [managed zone](/dns/docs/zones#create_managed_zones) for\na domain, add a DNS entry that will route the request, and execute\nthe transaction, complete the following steps.\nRepeat these steps for each of [several\ndomains](#domains) that you need to handle requests for, starting\nwith `*.notebooks.googleapis.com`.\n\n\nIn [Cloud Shell](https://console.cloud.google.com?cloudshell=true)\nor any environment where the [Google Cloud CLI](/sdk/docs)\nis installed, enter the following [Google Cloud CLI](/sdk/gcloud) commands.\n\n1.\n To create a private managed zone\n for one of the domains that your\n VPC network needs to handle:\n\n ```bash\n gcloud dns managed-zones create ZONE_NAME \\\n --visibility=private \\\n --networks=https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/NETWORK_NAME \\\n --dns-name=DNS_NAME \\\n --description=\"Description of your managed zone\"\n \n ```\n\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e: a name for the zone to create. You must use a separate zone for each domain. This zone name is used in each of the following steps.\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the ID of the project that hosts your VPC network\n - \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e: the name of the VPC network that you created earlier\n - \u003cvar translate=\"no\"\u003eDNS_NAME\u003c/var\u003e: the part of the domain name that comes after the `*.`, with a period on the end. For example, `*.notebooks.googleapis.com` has a \u003cvar translate=\"no\"\u003eDNS_NAME\u003c/var\u003e of `notebooks.googleapis.com.`\n2.\n Start a transaction.\n\n ```bash\n gcloud dns record-sets transaction start --zone=ZONE_NAME\n \n ```\n3.\n Add the following DNS A record. This reroutes traffic to\n Google's restricted IP addresses.\n\n ```bash\n gcloud dns record-sets transaction add \\\n --name=DNS_NAME. \\\n --type=A 199.36.153.4 199.36.153.5 199.36.153.6 199.36.153.7 \\\n --zone=ZONE_NAME \\\n --ttl=300\n \n ```\n4.\n Add the following DNS CNAME record to point to the A record\n that you just added. This redirects all traffic matching the\n domain to the IP addresses listed in the previous step.\n\n ```bash\n gcloud dns record-sets transaction add \\\n --name=\\*.DNS_NAME. \\\n --type=CNAME DNS_NAME. \\\n --zone=ZONE_NAME \\\n --ttl=300\n \n ```\n5.\n Execute the transaction.\n\n ```bash\n gcloud dns record-sets transaction execute --zone=ZONE_NAME\n \n ```\n6.\n Repeat these steps for each of the following domains. For each\n repetition, change \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e\n and \u003cvar translate=\"no\"\u003eDNS_NAME\u003c/var\u003e to the appropriate values for that\n domain. Keep \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e and \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e\n the same each time. You already\n completed these steps for `*.notebooks.googleapis.com`.\n\n - `*.notebooks.googleapis.com`\n - `*.notebooks.cloud.google.com`\n - `*.notebooks.googleusercontent.com`\n - `*.googleapis.com` to run code that interacts with other Google APIs and services\n\nUse Artifact Registry within your service perimeter\n---------------------------------------------------\n\nIf you want to use Artifact Registry in your service perimeter,\nsee [Configure restricted access for GKE\nprivate clusters](/artifact-registry/docs/gke-private-clusters).\n\nUse Shared VPC\n--------------\n\nIf you are using [Shared VPC](/vpc/docs/shared-vpc),\nyou must add the host and the service projects to the service\nperimeter. In the host project, you must also grant the\n[Compute Network User role](/iam/docs/understanding-roles#predefined)\n(`roles/compute.networkUser`) to the [Notebooks Service\nAgent](/iam/docs/service-agents#cloud-ai-platform-notebooks-service-account)\nfrom the service project. For more information, see [Managing\nservice perimeters](/vpc-service-controls/docs/manage-service-perimeters).\n\nAccess your managed notebooks instance\n--------------------------------------\n\n1. In the Google Cloud console, go to the **Managed notebooks** page.\n\n [Go to Managed notebooks](https://console.cloud.google.com/vertex-ai/workbench/managed)\n2. Next to your managed notebooks instance's name,\n click **Open JupyterLab**.\n\n3. If it's the first time you have accessed the\n managed notebooks instance's JupyterLab user interface,\n you must grant permission to access your data and authenticate\n your managed notebooks instance.\n\n 1. In the **Authenticate your managed notebook** dialog, click the button\n to get an authentication code.\n\n 2. Choose an account and click **Allow**. Copy the authentication code.\n\n 3. In the **Authenticate your managed notebook** dialog,\n paste the authentication code, and then click **Authenticate**.\n\nYour managed notebooks instance opens JupyterLab.\n\nLimitations\n-----------\n\n### Identity type for ingress and egress policies\n\nWhen you specify an ingress or egress policy for a service perimeter,\nyou can't use `ANY_SERVICE_ACCOUNT`\nor `ANY_USER_ACCOUNT` as an identity type for\nall [Vertex AI Workbench](/vertex-ai/docs/workbench)\noperations.\n\nInstead, use `ANY_IDENTITY` as the identity type.\n\n### Accessing the managed notebooks proxy from a workstation without internet\n\nTo access managed notebooks instances\nfrom a workstation with limited internet access,\nverify with your IT administrator that you can access the following domains:\n\n- `*.accounts.google.com`\n- `*.accounts.youtube.com`\n- `*.googleusercontent.com`\n- `*.kernels.googleusercontent.com`\n- `*.gstatic.com`\n- `*.notebooks.cloud.google.com`\n- `*.notebooks.googleapis.com`\n\nYou must have access to these domains for authentication to\nGoogle Cloud. See the previous section,\n[Configure your DNS entries using Cloud DNS](#configure-dns),\nfor further configuration information.\n\nWhat's next\n-----------\n\n- Learn more about [VPC Service Controls](/vpc-service-controls)."]]
