Added information about GKE private clusters and image access #1563

Oxxygenio · 2020-01-26T15:34:08Z

Added information on how it's possible to pull images from docker hub and other repositories when using GKE private cluster

This change is

googlebot · 2020-01-26T15:34:13Z

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

What to do if you already signed the CLA

Individual signers

It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

k8s-ci-robot · 2020-01-26T15:34:23Z

Hi @Oxxygenio. Thanks for your PR.

I'm waiting for a kubeflow member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Oxxygenio · 2020-01-26T15:37:16Z

/assign @richardsliu

sarahmaddox

Thanks for this suggestion @Oxxygenio! I've suggested adding extra information so that readers know more about the suggested solution without having to search and make assumptions about it.

sarahmaddox · 2020-01-28T00:48:26Z

content/docs/gke/private-clusters.md

@@ -48,6 +48,7 @@ from the nodes. Google services (such as BigQuery and Cloud Storage) are still a
 Importantly this means you can continue to use your [Google Container Registry (GCR)](https://cloud.google.com/container-registry/docs/) to host your Docker images. Other Docker registries (for example, DockerHub) will not be accessible. If you need to use Docker images
 hosted outside GCR you can use the scripts provided by Kubeflow to mirror them to your GCR registry.

+There is however still a way to pull images directly from DockerHub, or other repositories, and not having the hassle of re-writing deployment files. Activating Google NAT service to the subnet you are using, will give your pods egress access


@jlewi Please would you review this suggestion?

@Oxxygenio We need to give more information in the docs, so that readers know what the proposed solution is, whether it's applicable to them, and how they can use it. For example, you should expand the abbreviation "NAT" (I think it's Cloud NAT?), link to the docs (these? https://cloud.google.com/nat/docs/overview), and give an example to illustrate how people can use this option.

Thanks @sarahmaddox and @Oxxygenio.

Should we create a separate/new page that disucsses setting up a Cloud Nat and link to from the private GKE cluster page?

In the Cloud Nat Page it would be nice to have example commands that illustrate how to setup Cloud Nat.

On that page we could then have subsections corresponding to adding access for various services. So adding access to DockerHub would be one (and we could add others later as necessary).

The private GKE page could then just have something along the lines of
Alternatively follow these instructions to setup Cloud Nat to allow access to DockerHub.

@jlewi That's a good suggestion. A separate page about Cloud NAT provides more clarity for readers, and gives us more scope to expand the information.

@Oxxygenio Are you happy to create such a page?

Create a new file in this directory: https://github.com/kubeflow/website/tree/master/content/docs/gke

Copy the "page front matter" (the top lines between the plus signs) from the top of this page:
https://raw.githubusercontent.com/kubeflow/website/master/content/docs/gke/private-clusters.md

Paste the front matter into your new file, then change the page title etc in the front matter.

Add your content about Cloud NAT into the same file.

Add a link from the "private clusters" page pointing to your new page - that is, replace the content you added in this PR with the link instead.

If you do all that in this PR, then you'll be able to view your changes at the same preview link: https://deploy-preview-1563--competent-brattain-de2d6d.netlify.com/docs/gke/private-clusters/

You can also build the site locally and watch your changes appear in a local version of the docs as you type - see the README:
https://github.com/kubeflow/website/blob/master/README.md

@jlewi Do you think we should merge this PR and create an issue for the separation of this info into a new page? I don't know whether this content inherently belongs on this page or should be on a separate page from the beginning.

sarahmaddox · 2020-01-28T00:50:20Z

/assign @jlewi
/assign

sarahmaddox · 2020-01-28T00:51:53Z

@Oxxygenio Please would you sign the CLA as suggested by the googlebot in a previous comment. When you've signed the CLA, add a comment to this PR with the words @googlebot I signed it!. That will prompt the bot to run the CLA check again.

googlebot · 2020-01-28T00:51:57Z

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

sarahmaddox · 2020-01-28T00:52:35Z

Oh great, the CLA check has now run successfully. Thanks!

Oxxygenio · 2020-01-28T07:03:55Z

@jlewi ill update it with information and a use-case :)

googlebot · 2020-01-28T07:41:09Z

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google.
In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

k8s-ci-robot · 2020-01-28T07:41:15Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign jlewi
You can assign the PR to them by writing /assign @jlewi in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…emoved formating

Oxxygenio · 2020-01-28T08:38:09Z

@googlebot I signed it!

Oxxygenio · 2020-01-28T08:42:04Z

@googlebot I fixed it.

googlebot · 2020-01-28T08:42:11Z

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

Oxxygenio · 2020-01-28T08:43:54Z

@sarahmaddox and @jlewi I had to go back in and fix the Markdown. for some reason the numbering broke completely, even something easy as getting the original document in raw form on GitHub breaks the numbers. Please re-review, so that it looks 100% on your end.

jlewi · 2020-01-28T17:48:24Z

content/docs/gke/private-clusters.md

@@ -80,7 +84,7 @@ export PROJECT_NUMBER=$(gcloud projects describe ${PROJECT} --format='value(proj
                           dns.googleapis.com  --project=${PROJECT}
    ```

-1. Check if you have an access policy object already created:
+2. Check if you have an access policy object already created:


Why are you explicitly changing the numbering rather than letting markdown auto enumerate it for you?

@Oxxygenio just saw your comment about numbering. I would suggest reverting the numbering changes and then we should try to figure out why the numbering is broken

FYI, here's the preview of your PR, where you can see how the page looks with your changes included, when built by Netlify for the doc website:
https://deploy-preview-1563--competent-brattain-de2d6d.netlify.com/docs/gke/private-clusters/
Netlify builds the preview each time you push a commit up to GitHub.

sarahmaddox · 2020-01-29T04:01:52Z

/ok-to-test

sarahmaddox · 2020-02-08T17:26:43Z

@Oxxygenio How are you doing with the suggested updates?

Oxxygenio · 2020-02-10T14:32:17Z

@sarahmaddox That should set it right.
Edit: Sorry, I had totally missed the replies in my email.

sarahmaddox

Thanks! A couple more suggestions, and I'll leave it up to @jlewi to decide whether we should merge this and create an issue for the separate page.

sarahmaddox · 2020-02-10T15:47:28Z

content/docs/gke/private-clusters.md

@@ -48,6 +48,11 @@ from the nodes. Google services (such as BigQuery and Cloud Storage) are still a
 Importantly this means you can continue to use your [Google Container Registry (GCR)](https://cloud.google.com/container-registry/docs/) to host your Docker images. Other Docker registries (for example, DockerHub) will not be accessible. If you need to use Docker images
 hosted outside GCR you can use the scripts provided by Kubeflow to mirror them to your GCR registry.

+There is however still a way to pull images directly from DockerHub, or other repositories, and not having the hassle of re-writing deployment files. Activating Google's [Cloud NAT](https://cloud.google.com/nat/docs/overview/)(Network Address Translation) service to the subnet you are using, will give your pods egress access.


Add a space before (Network Address Translation). See preview: https://deploy-preview-1563--competent-brattain-de2d6d.netlify.com/docs/gke/private-clusters/

sarahmaddox · 2020-02-10T15:47:57Z

content/docs/gke/private-clusters.md

@@ -48,6 +48,11 @@ from the nodes. Google services (such as BigQuery and Cloud Storage) are still a
 Importantly this means you can continue to use your [Google Container Registry (GCR)](https://cloud.google.com/container-registry/docs/) to host your Docker images. Other Docker registries (for example, DockerHub) will not be accessible. If you need to use Docker images
 hosted outside GCR you can use the scripts provided by Kubeflow to mirror them to your GCR registry.

+There is however still a way to pull images directly from DockerHub, or other repositories, and not having the hassle of re-writing deployment files. Activating Google's [Cloud NAT](https://cloud.google.com/nat/docs/overview/)(Network Address Translation) service to the subnet you are using, will give your pods egress access.
+One use-case where this is very helpful is when you are using command tools that install several components and rely on publicly available images.
+[Istio](https://istio.io/docs/setup/install/istioctl/) with its istioctl is a good example: _istioctl manifest apply_


Add a full stop (period) after apply_.

sarahmaddox · 2020-02-10T15:48:33Z

content/docs/gke/private-clusters.md

+There is however still a way to pull images directly from DockerHub, or other repositories, and not having the hassle of re-writing deployment files. Activating Google's [Cloud NAT](https://cloud.google.com/nat/docs/overview/)(Network Address Translation) service to the subnet you are using, will give your pods egress access.
+One use-case where this is very helpful is when you are using command tools that install several components and rely on publicly available images.
+[Istio](https://istio.io/docs/setup/install/istioctl/) with its istioctl is a good example: _istioctl manifest apply_
+Generating and editing the manifest file is timeconsuming and error-prone.


Suggestion: Remove this sentence about editing the manifest file. As a reader, I found it a little unexpected at this location.

jlewi · 2020-02-10T18:26:37Z

@Oxxygenio Could we provide more information about how to setup Cloud Nat? In particular, can we provide gcloud commands that users can run?

As mentioned earlier it might be nice to move that into its own page or at least make it a new section.

sarahmaddox · 2020-03-07T17:40:11Z

@Oxxygenio Friendly ping - please would you take a look at the review comments on this PR?

sarahmaddox · 2020-03-20T04:38:50Z

@Oxxygenio It looks like you've run out of time to work on this PR. Also, we're planning a large-scale update to the docs - see issue #1705. I've linked this PR to that issue, so that the engineers can take your work into account too.

Thanks so much for your contribution to the docs! I'll close this PR now, but please do re-open it if you plan to work further on it.

/close

k8s-ci-robot · 2020-03-20T04:38:52Z

@sarahmaddox: Closed this PR.

In response to this:

@Oxxygenio It looks like you've run out of time to work on this PR. Also, we're planning a large-scale update to the docs - see issue #1705. I've linked this PR to that issue, so that the engineers can take your work into account too.

Thanks so much for your contribution to the docs! I'll close this PR now, but please do re-open it if you plan to work further on it.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Added information about GKE private clusters and image access

2cc04b7

k8s-ci-robot added the size/XS label Jan 26, 2020

k8s-ci-robot requested review from richardsliu and texasmichelle January 26, 2020 15:34

k8s-ci-robot added the needs-ok-to-test label Jan 26, 2020

k8s-ci-robot assigned richardsliu Jan 26, 2020

sarahmaddox suggested changes Jan 28, 2020

View reviewed changes

k8s-ci-robot assigned jlewi and sarahmaddox Jan 28, 2020

Updated information on private GKE, with usecase and documentation

3a50681

k8s-ci-robot added size/L and removed size/XS labels Jan 28, 2020

Updated information on private GKE, with usecase and documentation, r…

eedd58f

…emoved formating

k8s-ci-robot added size/XS and removed size/L labels Jan 28, 2020

Updated information on private GKE, fixed broken markdown

56d59a6

k8s-ci-robot added size/M and removed size/XS labels Jan 28, 2020

Oxxygenio requested a review from sarahmaddox January 28, 2020 09:26

jlewi reviewed Jan 28, 2020

View reviewed changes

k8s-ci-robot added ok-to-test and removed needs-ok-to-test labels Jan 29, 2020

Numbering reverted

9f9435c

k8s-ci-robot added size/XS and removed size/M labels Feb 10, 2020

sarahmaddox reviewed Feb 10, 2020

View reviewed changes

sarahmaddox mentioned this pull request Mar 16, 2020

[GCP] Update docs for private clusters and VPC service controls for 1.0 #1705

Closed

k8s-ci-robot closed this Mar 20, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added information about GKE private clusters and image access #1563

Added information about GKE private clusters and image access #1563

Oxxygenio commented Jan 26, 2020 •

edited by jlewi

Loading

googlebot commented Jan 26, 2020

k8s-ci-robot commented Jan 26, 2020

Oxxygenio commented Jan 26, 2020

sarahmaddox left a comment

sarahmaddox Jan 28, 2020

jlewi Jan 28, 2020

sarahmaddox Jan 29, 2020

sarahmaddox Feb 10, 2020

sarahmaddox commented Jan 28, 2020

sarahmaddox commented Jan 28, 2020

googlebot commented Jan 28, 2020

sarahmaddox commented Jan 28, 2020

Oxxygenio commented Jan 28, 2020

googlebot commented Jan 28, 2020

k8s-ci-robot commented Jan 28, 2020

Oxxygenio commented Jan 28, 2020

Oxxygenio commented Jan 28, 2020

googlebot commented Jan 28, 2020

Oxxygenio commented Jan 28, 2020

jlewi Jan 28, 2020

jlewi Jan 28, 2020

sarahmaddox Jan 28, 2020

sarahmaddox commented Jan 29, 2020

sarahmaddox commented Feb 8, 2020

Oxxygenio commented Feb 10, 2020 •

edited

Loading

sarahmaddox left a comment

sarahmaddox Feb 10, 2020

sarahmaddox Feb 10, 2020

sarahmaddox Feb 10, 2020

jlewi commented Feb 10, 2020

sarahmaddox commented Mar 7, 2020

sarahmaddox commented Mar 20, 2020

k8s-ci-robot commented Mar 20, 2020

Added information about GKE private clusters and image access #1563

Added information about GKE private clusters and image access #1563

Conversation

Oxxygenio commented Jan 26, 2020 • edited by jlewi Loading

googlebot commented Jan 26, 2020

What to do if you already signed the CLA

Individual signers

Corporate signers

k8s-ci-robot commented Jan 26, 2020

Oxxygenio commented Jan 26, 2020

sarahmaddox left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sarahmaddox commented Jan 28, 2020

sarahmaddox commented Jan 28, 2020

googlebot commented Jan 28, 2020

sarahmaddox commented Jan 28, 2020

Oxxygenio commented Jan 28, 2020

googlebot commented Jan 28, 2020

k8s-ci-robot commented Jan 28, 2020

Oxxygenio commented Jan 28, 2020

Oxxygenio commented Jan 28, 2020

googlebot commented Jan 28, 2020

Oxxygenio commented Jan 28, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sarahmaddox commented Jan 29, 2020

sarahmaddox commented Feb 8, 2020

Oxxygenio commented Feb 10, 2020 • edited Loading

sarahmaddox left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jlewi commented Feb 10, 2020

sarahmaddox commented Mar 7, 2020

sarahmaddox commented Mar 20, 2020

k8s-ci-robot commented Mar 20, 2020

Oxxygenio commented Jan 26, 2020 •

edited by jlewi

Loading

Oxxygenio commented Feb 10, 2020 •

edited

Loading