From 5937f39c16502c5105fb114f4928fb5092db2173 Mon Sep 17 00:00:00 2001 From: huong8373tt-beep <294879785+huong8373tt-beep@users.noreply.github.com> Date: Thu, 22 Oct 2026 14:54:07 +0800 Subject: [PATCH] fix(blueprints): apply Workbench notebook owners --- blueprints/fedramp-high/vertex-mlops/README.md | 1 + blueprints/fedramp-high/vertex-mlops/terraform.tfvars.sample | 3 ++- blueprints/fedramp-high/vertex-mlops/vertex.tf | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/blueprints/fedramp-high/vertex-mlops/README.md b/blueprints/fedramp-high/vertex-mlops/README.md index 678e6ba8f..baad11b41 100644 --- a/blueprints/fedramp-high/vertex-mlops/README.md +++ b/blueprints/fedramp-high/vertex-mlops/README.md @@ -30,6 +30,7 @@ The blueprint will deploy all the required resources to have a fully functional ## Instructions ### Deploy the experimentation environment - Create a `terraform.tfvars` file and specify the variables to match your desired configuration. You can use the provided `terraform.tfvars.sample` as reference. +- For a `USER_MANAGED` notebook, set its optional `owner` to the user email that should be listed as the Workbench instance owner. `MANAGED` notebooks require `owner`. - Before choosing a region to create your resources in, it is recommended to view your system [quotas](https://console.cloud.google.com/iam-admin/quotas) in order to check which regions have access to GPU and TPU accelerators. If you choose a region where the quota is 0, you will have to request a quota increase (common accelerators are NVIDIA_A100 and NVIDIA_H100). It is recommended to create project resources in the 'us-central1' region. - When configuring your network settings, remeber that you must use a shared VPC. It is recomended that you have a separate 'networking project' that manages network traffic, and share this VPC to any projects that need access to it. This shared VPC must have internet access or JupyterLabs will not work. In addition, the account that runs the terraform code must have the Compute Shared VPC Admin role at an organization level. - Run `terraform init` and `terraform apply` diff --git a/blueprints/fedramp-high/vertex-mlops/terraform.tfvars.sample b/blueprints/fedramp-high/vertex-mlops/terraform.tfvars.sample index 854f93e7d..e6deb9f3c 100644 --- a/blueprints/fedramp-high/vertex-mlops/terraform.tfvars.sample +++ b/blueprints/fedramp-high/vertex-mlops/terraform.tfvars.sample @@ -15,7 +15,8 @@ region = "us-central" # us-central1 is recommended notebooks = { "notebook-00" = { - type = "USER_MANAGED" + type = "USER_MANAGED" + owner = "user@example.com" } } diff --git a/blueprints/fedramp-high/vertex-mlops/vertex.tf b/blueprints/fedramp-high/vertex-mlops/vertex.tf index a8dc52e0f..35ea231b9 100644 --- a/blueprints/fedramp-high/vertex-mlops/vertex.tf +++ b/blueprints/fedramp-high/vertex-mlops/vertex.tf @@ -118,7 +118,7 @@ resource "google_workbench_instance" "playground" { disable_proxy_access = false - instance_owners = try(tolist(var.notebooks[each.key].owner), null) + instance_owners = var.notebooks[each.key].owner == null ? null : [var.notebooks[each.key].owner] depends_on = [ google_project_iam_member.shared_vpc,