diff --git a/applications/jupyter/main.tf b/applications/jupyter/main.tf index e497d59a4..3998a5255 100644 --- a/applications/jupyter/main.tf +++ b/applications/jupyter/main.tf @@ -51,7 +51,7 @@ module "project-services" { "servicenetworking.googleapis.com", "serviceusage.googleapis.com", "sourcerepo.googleapis.com", - (var.add_auth ? ["iap.googleapis.com"] : []) + "iap.googleapis.com" ]) } diff --git a/applications/jupyter/metadata.display.yaml b/applications/jupyter/metadata.display.yaml index 9ee7c69a3..bd7e8d562 100644 --- a/applications/jupyter/metadata.display.yaml +++ b/applications/jupyter/metadata.display.yaml @@ -32,12 +32,29 @@ spec: variables: acknowledge: name: acknowledge - title: Confirm that all prerequisites have been met. + title: Check to confirm you enabled Google APIs for your project with this command. section: acknowledge - subtext: This solution will incur additional costs due to resource creation and necessary Google API usage. Please confirm to proceed. + subtext: | + 
+                    gcloud services enable serviceusage.googleapis.com cloudresourcemanager.googleapis.com
+
enumValueLabels: - label: Confirm that all prerequisites have been met. value: "true" + solution_deployment_view: + name: solution_deployment_view + title: Check to confirm that upon deployment completion, you need to go to the Solution deployment page, find your deployment, and follow suggested next steps on the deployment DETAILS tab. + section: acknowledge + subtext:

+ Solution deployment page +

+ enumValueLabels: + - label: Confirm that all prerequisites have been met. + value: "true" + iap_consent_info: + name: iap_consent_info + title: Confirm your OAuth consent screen is configured correctly. + section: iap_auth add_auth: name: add_auth title: Enable IAP Authentication @@ -46,12 +63,16 @@ spec: name: additional_labels title: Additional Labels invisible: true - section: cluster_details + section: required_config autopilot_cluster: name: autopilot_cluster title: GKE Cluster Type - section: cluster_details + section: required_config invisible: true + cluster_name: + name: cluster_name + title: GKE cluster name + section: required_config client_id: name: client_id title: Client Id @@ -65,18 +86,14 @@ spec: cluster_location: name: cluster_location title: Cluster Location - section: cluster_details + section: required_config xGoogleProperty: type: ET_GCE_REGION cluster_membership_id: name: cluster_membership_id title: Cluster Membership Id invisible: true - section: cluster_details - cluster_name: - name: cluster_name - title: Cluster Name - section: cluster_details + section: required_config create_brand: name: create_brand title: Create Brand @@ -85,7 +102,7 @@ spec: create_cluster: name: create_cluster title: Create GKE Cluster - section: cluster_details + section: required_config invisible: true create_gcs_bucket: name: create_gcs_bucket @@ -97,12 +114,12 @@ spec: invisible: true domain: name: domain - title: Domain + title: Domain to host JupyterHub section: iap_auth gcs_bucket: name: gcs_bucket title: GCS Bucket - section: jupyterhub + section: required_config xGoogleProperty: type: ET_GCS_BUCKET goog_cm_deployment_name: @@ -142,10 +159,10 @@ spec: name: kubernetes_namespace title: Kubernetes Namespace invisible: true - section: cluster_details + section: required_config members_allowlist: name: members_allowlist - title: Members Allowlist + title: Allowlist users to access JupyterHub section: iap_auth network_name: name: network_name @@ -155,7 +172,7 @@ spec: name: private_cluster title: Private Cluster invisible: true - section: cluster_details + section: required_config project_id: name: project_id title: Project Id @@ -173,40 +190,50 @@ spec: name: workload_identity_service_account title: GCP Workload Identity Service Account invisible: true - section: jupyterhub + section: required_config sections: - - name: cluster_details - title: New GKE Cluster Configuration - - name: jupyterhub - title: Other Configuration + - name: acknowledge + title: Before you begin + subtext: + This solution deploys a sample JupyterHub application on GKE in your project to run your Jupyter notebooks.
+ - name: required_config + title: Required configuration - name: iap_auth - title: Configure Authenticated Access for JupyterHub - subtext: Make sure the OAuth Consent Screen is configured for your project. Ensure User type is set to Internal. Note that by default, only users within your organization can be allowlisted. To add external users, change the User type to External after the application is deployed. + title: Optional authentication with Identity-Aware Proxy + subtext: With IAP authentication, you can control user access to JupyterHub. To use IAP, you will need to do the following:
+

+   • Identify a domain for JupyterHub, and
+   • Create DNS A records for the domain after the application is deployed. +

+ Without IAP, users will need to access the GKE cluster and use port-forward to connect to JupyterHub. runtime: outputMessage: Deployment can take several minutes to complete. suggestedActions: - heading: "Step 1: Create DNS A Records for JupyterHub" description: If using custom domains for JupyterHub, create DNS A record set (Google DNS Record Set). Propagation takes 10-15 minutes and logging in won’t succeed until it’s done. - - heading: "Step 2: Go to JupyterHub Application" + - heading: "Step 2: Launch JupyterHub" description: |- -
  • If IAP is enabled, log in with your organization's credentials. SSL or cert errors indicate the cert is provisioning which takes up to 20 minutes.
    • -
  • If IAP is disabled: -