[OSDOCS-6942]:OSD on GCP can be installed into Shared VPC (XPN) by mletalie · Pull Request #66312 · openshift/openshift-docs

mletalie · 2023-10-16T21:36:42Z

Version(s):

4.14+
Issue:

https://issues.redhat.com/browse/OSDOCS-6942
Link to docs preview:

https://66312--docspreview.netlify.app/openshift-dedicated/latest/osd_install_access_delete_cluster/creating-a-gcp-cluster#osd-create-gcp-cluster-ccs_osd-creating-a-cluster-on-gcp
(Scroll to step 15. Changes happen between steps 15-17, and a note is added after step 20).

https://66312--docspreview.netlify.app/openshift-dedicated/latest/osd_install_access_delete_cluster/osd-deleting-a-cluster
Note at end of steps.
QE review:

QE has approved this change.

Additional information:

ocpdocs-previewbot · 2023-10-16T21:42:20Z

🤖 Updated build preview is available at:
https://66312--docspreview.netlify.app

Build log: https://circleci.com/gh/ocpdocs-previewbot/openshift-docs/31688

mletalie · 2023-10-17T14:22:05Z

Hello @svmrh,
Please see the draft for this topic here (starting on step 15) https://66312--docspreview.netlify.app/openshift-dedicated/latest/osd_install_access_delete_cluster/creating-a-gcp-cluster#osd-create-gcp-cluster-ccs_osd-creating-a-cluster-on-gcp

Questions:

Do you think we need a link in the first "Important" note that points users to info regarding enabling a project as a host project?
In the second "Important" note, it states "...who must grant the service account..." Do we need to specify that the service account is auto-generated once the steps in the wizard are completed (I think that is the case from watching the demo) and that service account ID needs to be given to the host project administrator so they can grant those permissions to that service account?
Do you think that the placement of this "Important" note is correct, or would it make more sense at the end of the steps in the docs?
Do you think in step 16 we need to change the first sentence to reflect the option we have added (ie shared GPC VPC)? Maybe not necessary, b/c user has to have opted to install the cluster in an existing GCP VPC to access installing the cluster in a shared VPC...but let me know what you think.
Overall, do think anymore specific information needs to be added for user to use this feature? Not sure if we need to go deeper into the specifics given we are linking out to Google docs that are overall pretty informative.

Thanks for your help!

svmrh · 2023-10-18T15:44:41Z

@mletalie : Thanks for putting this together.

The placement of the first "IMPORTANT" note if fine. Yes, it will be good to point users to the GCP documentation on Shared VPC. Here's the link to GCP documentation explaining the steps to enable a host project.
https://cloud.google.com/vpc/docs/provisioning-shared-vpc#set-up-shared-vpc

Do you think it makes sense to also add a link to general overview on what is Shared VPC in Google Cloud?
https://cloud.google.com/vpc/docs/shared-vpc

For the IMPORTANT note in 15.b, can we make it explicit that the cluster admin has to complete the steps within the cluster configuration wizard and hit submit. I have made minor edits. Please check if it looks okay

Once you complete the steps within the cluster configuration wizard and click "Create Cluster", the cluster will go into "Installation Pending" state. At this point, you must contact the VPC administrator of the host project, who must grant the dynamically generated service account the following permissions: Computer Network Administrator, Compute Security Administrator, and DNS Administrator. The administrator has 30 days to grant the listed permissions before the cluster creation fails. For information about shared GPC VPC permissions, see Provision shared VPC.

the placement of the second IMPORTANT note is fine here (i.e. in step 15.b). Placing it towards the end of all the steps (i.e. after step 20) might be a little off context. What are your thoughts?
Yeah, no need of adding references to the Shared VPC option in step 16. This is because the users can install into an existing VPC (i.e. do step 16) and still skip the Shared VPC configuration.

Let's share this MR in tomorrow's (Thursday, Oct 19th) team meeting and request everyone to review changes.

mletalie · 2023-10-19T19:38:58Z

@mletalie : Thanks for putting this together.

The placement of the first "IMPORTANT" note if fine. Yes, it will be good to point users to the GCP documentation on Shared VPC. Here's the link to GCP documentation explaining the steps to enable a host project.
https://cloud.google.com/vpc/docs/provisioning-shared-vpc#set-up-shared-vpc

Do you think it makes sense to also add a link to general overview on what is Shared VPC in Google Cloud? https://cloud.google.com/vpc/docs/shared-vpc

For the IMPORTANT note in 15.b, can we make it explicit that the cluster admin has to complete the steps within the cluster configuration wizard and hit submit. I have made minor edits. Please check if it looks okay

Once you complete the steps within the cluster configuration wizard and click "Create Cluster", the cluster will go into "Installation Pending" state. At this point, you must contact the VPC administrator of the host project, who must grant the dynamically generated service account the following permissions: Computer Network Administrator, Compute Security Administrator, and DNS Administrator. The administrator has 30 days to grant the listed permissions before the cluster creation fails. For information about shared GPC VPC permissions, see Provision shared VPC.

the placement of the second IMPORTANT note is fine here (i.e. in step 15.b). Placing it towards the end of all the steps (i.e. after step 20) might be a little off context. What are your thoughts?

Yeah, no need of adding references to the Shared VPC option in step 16. This is because the users can install into an existing VPC (i.e. do step 16) and still skip the Shared VPC configuration.

Let's share this MR in tomorrow's (Thursday, Oct 19th) team meeting and request everyone to review changes.

Thanks @svmrh, will take a look at your responses and get back to you ASAP. Appreciate it!

mletalie · 2023-10-23T15:05:12Z

Hello @svmrh,
Thanks again for feedback. See responses below:

@mletalie : Thanks for putting this together.

The placement of the first "IMPORTANT" note if fine. Yes, it will be good to point users to the GCP documentation on Shared VPC. Here's the link to GCP documentation explaining the steps to enable a host project.
https://cloud.google.com/vpc/docs/provisioning-shared-vpc#set-up-shared-vpc
DONE
Do you think it makes sense to also add a link to general overview on what is Shared VPC in Google Cloud? https://cloud.google.com/vpc/docs/shared-vpc

For the IMPORTANT note in 15.b, can we make it explicit that the cluster admin has to complete the steps within the cluster configuration wizard and hit submit. I have made minor edits. Please check if it looks okay

Once you complete the steps within the cluster configuration wizard and click "Create Cluster", the cluster will go into "Installation Pending" state. At this point, you must contact the VPC administrator of the host project, who must grant the dynamically generated service account the following permissions: Computer Network Administrator, Compute Security Administrator, and DNS Administrator. The administrator has 30 days to grant the listed permissions before the cluster creation fails. For information about shared GPC VPC permissions, see Provision shared VPC.
DONE

the placement of the second IMPORTANT note is fine here (i.e. in step 15.b). Placing it towards the end of all the steps (i.e. after step 20) might be a little off context. What are your thoughts?
I think it is good as is. Thanks!

Yeah, no need of adding references to the Shared VPC option in step 16. This is because the users can install into an existing VPC (i.e. do step 16) and still skip the Shared VPC configuration.
Sounds good. Appreciate the clarity!
Let's share this MR in tomorrow's (Thursday, Oct 19th) team meeting and request everyone to review changes.

Thanks @svmrh, will take a look at your responses and get back to you ASAP. Appreciate it!

Thanks @svmrh, please see comments above. Appreciate it!

mletalie · 2023-10-23T20:53:42Z

Hello reviewers, please see https://redhat-internal.slack.com/archives/D04KG1N67MZ/p1698090978994849 which describes why I needed to conditionalize out the hyperlink to keep the build from breaking.

mletalie · 2023-10-30T16:29:51Z

Hello @jianli-wei, when you get a moment can you please review the doc changes brought forth in these docs? Thanks!

svmrh · 2023-11-01T22:01:40Z

LGTM.

A few minor comments -

Does it makes sense to repeat this note on Deleting an OpenShift Dedicated cluster page as well?
@ckandag - Should we tweak step 16 a little to say something like "If you are installing into a GCP shared VPC, the VPC name and subnets are being shared from the host project..."

@jianli-wei - can you please review the doc changes and give a QE 👍

Thanks @mletalie for driving the documentation changes for this feature.

jianli-wei · 2023-11-02T02:25:25Z

+ifdef::osd-on-gcp[]
+[NOTE]
+====
+If you delete a cluster that was installed into a GCP shared VPC, you must inform the VPC owner of the host project to remove the service account and the roles granted to the service account that was referenced during the creation of the cluster.


In fact, the service account itself would be deleted during the cluster deletion. So suggest to put it like below,

... you must inform the VPC owner of the host project to remove the IAM policy binding of the service account and its binding roles in the host project.

In fact, the service account itself would be deleted during the cluster deletion. So suggest to put it like below,

... you must inform the VPC owner of the host project to remove the IAM policy binding of the service account and its binding roles in the host project.

Thanks @jianli-wei,
I applied your suggestion with just a slight tweak in wording to fit the narrative prior to that note. Thanks for the clarity.

mletalie · 2023-11-02T16:50:48Z

LGTM.

A few minor comments -

Does it makes sense to repeat this note on Deleting an OpenShift Dedicated cluster page as well?

@ckandag - Should we tweak step 16 a little to say something like "If you are installing into a GCP shared VPC, the VPC name and subnets are being shared from the host project..."

@jianli-wei - can you please review the doc changes and give a QE 👍

Thanks @mletalie for driving the documentation changes for this feature.

Hello @svmrh,
For point #1, I have added a note to that doc:

For point #2, I have added a note:

svmrh · 2023-11-02T17:13:54Z

Thanks @mletalie and @jianli-wei

svmrh · 2023-11-02T19:39:32Z

Do not publish these changes just yet.

Engineering team is facing issues provisioning an OSD cluster into GCP Shared VPC with 4.14.x images (no issues seen in case of 4.13.x images). So, until this is resolved, do not publish the content changes for this feature.
Slack thread used for triaging this issue: https://redhat-internal.slack.com/archives/CCX9DB894/p1698949140705799

svmrh · 2023-11-02T21:55:25Z

[Thursday, Nov 2nd 2:55pm PT] Update:
The issue has been resolved. After applying the fix, 4.14 OSD cluster install into a GCP Shared VPC was successful. But given the last minute hiccup, the plan is to go GA on Monday.

We will wait for QE to run sanity tests in production env and confirm if everything looks good.

I will update this thread on Monday once everything looks good.

jneczypor

I took a look and added comments for a few changes. LGTM!

EricPonvelle

I just had one small follow up, but looks good.

mletalie · 2023-11-03T14:01:01Z

/remove-label peer-review-needed

mletalie · 2023-11-03T14:01:36Z

/label peer-review-done

svmrh · 2023-11-07T19:59:42Z

Both backend and UI changes for this feature are enabled in production. Even the feature flag is removed for all orgs. Please kickoff the process for publishing the content updates for XCMSTRAT-91

EricPonvelle

/lgtm

EricPonvelle · 2023-11-07T20:15:00Z

/cherrypick enterprise-4.14

EricPonvelle · 2023-11-07T20:15:05Z

/cherrypick enterprise-4.15

openshift-cherrypick-robot · 2023-11-07T20:15:47Z

@EricPonvelle: new pull request created: #67537

Details

In response to this:

/cherrypick enterprise-4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-cherrypick-robot · 2023-11-07T20:15:50Z

@EricPonvelle: new pull request created: #67538

Details

In response to this:

/cherrypick enterprise-4.15

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Oct 16, 2023

mletalie force-pushed the OSDOCS-6942 branch from 86ccdf4 to 2bf8354 Compare October 16, 2023 21:37

mletalie changed the title ~~Osdocs 6942~~ [OSDOCS-6942]:OSD on GCP can be installed into Shared VPC (XPN) Oct 17, 2023

mletalie marked this pull request as draft October 17, 2023 14:16

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 17, 2023

mletalie force-pushed the OSDOCS-6942 branch 2 times, most recently from 1eed167 to cdfad8d Compare October 23, 2023 18:49

mletalie marked this pull request as ready for review October 23, 2023 18:52

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 23, 2023

mletalie force-pushed the OSDOCS-6942 branch 3 times, most recently from 5d261a8 to 663417e Compare October 26, 2023 13:45

openshift-ci Bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Oct 26, 2023

mletalie force-pushed the OSDOCS-6942 branch 2 times, most recently from 34b1cb5 to 2fc8596 Compare October 30, 2023 12:31

jianli-wei suggested changes Nov 2, 2023

View reviewed changes

mletalie force-pushed the OSDOCS-6942 branch from 2fc8596 to 23fd462 Compare November 2, 2023 13:29

mletalie force-pushed the OSDOCS-6942 branch 2 times, most recently from 7059c8a to abd796b Compare November 2, 2023 17:31

EricPonvelle closed this Nov 2, 2023

EricPonvelle reopened this Nov 2, 2023

EricPonvelle added peer-review-in-progress Signifies that the peer review team is reviewing this PR branch/enterprise-4.14 branch/enterprise-4.15 labels Nov 2, 2023

jneczypor reviewed Nov 2, 2023

View reviewed changes

EricPonvelle reviewed Nov 2, 2023

View reviewed changes

Comment thread modules/osd-create-cluster-ccs.adoc Outdated

EricPonvelle added peer-review-needed Signifies that the peer review team needs to review this PR and removed peer-review-in-progress Signifies that the peer review team is reviewing this PR labels Nov 2, 2023

mletalie force-pushed the OSDOCS-6942 branch from abd796b to 3b69caa Compare November 3, 2023 12:44

shared VPC GPC

acfa668

mletalie force-pushed the OSDOCS-6942 branch from 3b69caa to acfa668 Compare November 3, 2023 13:24

openshift-ci Bot removed the peer-review-needed Signifies that the peer review team needs to review this PR label Nov 3, 2023

openshift-ci Bot added the peer-review-done Signifies that the peer review team has reviewed this PR label Nov 3, 2023

EricPonvelle approved these changes Nov 7, 2023

View reviewed changes

openshift-ci Bot assigned EricPonvelle Nov 7, 2023

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Nov 7, 2023

EricPonvelle merged commit 7697e7e into openshift:main Nov 7, 2023

openshift-cherrypick-robot mentioned this pull request Nov 7, 2023

[enterprise-4.14] [OSDOCS-6942]:OSD on GCP can be installed into Shared VPC (XPN) #67537

Merged

openshift-cherrypick-robot mentioned this pull request Nov 7, 2023

[enterprise-4.15] [OSDOCS-6942]:OSD on GCP can be installed into Shared VPC (XPN) #67538

Merged

Conversation

mletalie commented Oct 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented Oct 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mletalie commented Oct 17, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

svmrh commented Oct 18, 2023

Uh oh!

mletalie commented Oct 19, 2023

Uh oh!

mletalie commented Oct 23, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mletalie commented Oct 23, 2023

Uh oh!

mletalie commented Oct 30, 2023

Uh oh!

svmrh commented Nov 1, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jianli-wei Nov 2, 2023

Choose a reason for hiding this comment

Uh oh!

mletalie Nov 2, 2023

Choose a reason for hiding this comment

Uh oh!

mletalie commented Nov 2, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

svmrh commented Nov 2, 2023

Uh oh!

svmrh commented Nov 2, 2023

Uh oh!

svmrh commented Nov 2, 2023

Uh oh!

jneczypor left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

EricPonvelle left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mletalie commented Nov 3, 2023

Uh oh!

mletalie commented Nov 3, 2023

Uh oh!

svmrh commented Nov 7, 2023 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

EricPonvelle left a comment

Choose a reason for hiding this comment

Uh oh!

EricPonvelle commented Nov 7, 2023

Uh oh!

EricPonvelle commented Nov 7, 2023

Uh oh!

openshift-cherrypick-robot commented Nov 7, 2023

Uh oh!

openshift-cherrypick-robot commented Nov 7, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

mletalie commented Oct 16, 2023 •

edited

Loading

ocpdocs-previewbot commented Oct 16, 2023 •

edited

Loading

mletalie commented Oct 17, 2023 •

edited

Loading

mletalie commented Oct 23, 2023 •

edited

Loading

svmrh commented Nov 1, 2023 •

edited

Loading

mletalie commented Nov 2, 2023 •

edited

Loading

svmrh commented Nov 7, 2023 •

edited by openshift-ci Bot

Loading