서비스 경계에 프로젝트를 추가할 때 관리형 노트북 인스턴스가 포함된 프로젝트를 추가합니다.
서비스를 서비스 경계에 추가할 때 Notebooks API를 추가합니다.
필요한 프로젝트 및 서비스를 추가하지 않고 서비스 경계를 만들었을 때 서비스 경계를 업데이트하는 방법은 서비스 경계 관리를 참조하세요.
Cloud DNS를 사용하여 DNS 항목 구성
Vertex AI Workbench 관리형 노트북 인스턴스는 Virtual Private Cloud 네트워크에서 기본적으로 처리하지 않는 도메인 여러 개를 사용합니다.
VPC 네트워크에서 이러한 도메인으로 전송된 요청을 올바르게 처리하도록 하려면 Cloud DNS를 사용하여 DNS 레코드를 추가합니다. VPC 경로에 대한 자세한 내용은 경로를 참조하세요.
도메인의 관리형 영역을 만들려면 요청을 라우팅할 DNS 항목을 추가하고 트랜잭션을 실행한 후 다음 단계를 완료합니다.
요청을 처리해야 하는 *.notebooks.googleapis.com으로 시작하는 여러 도메인 각각에 이러한 단계를 반복합니다.
VPC 네트워크에서 처리해야 하는 도메인 중 하나의 비공개 관리 영역을 만들려면 다음을 실행합니다.
gclouddnsmanaged-zonescreateZONE_NAME\--visibility=private\--networks=https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/NETWORK_NAME\--dns-name=DNS_NAME\--description="Description of your managed zone"
다음을 바꿉니다.
ZONE_NAME: 만들 영역의 이름.
도메인마다 별도의 영역을 사용해야 합니다. 이 영역 이름은 다음 각 단계에서 사용됩니다.
PROJECT_ID: VPC 네트워크를 호스팅하는 프로젝트의 ID
NETWORK_NAME: 이전에 만든 VPC 네트워크의 이름
DNS_NAME: *. 뒤에 오는 도메인 이름의 일부로서 끝에 마침표가 있음.
예를 들어 *.notebooks.googleapis.com의 notebooks.googleapis.com.은 DNS_NAME입니다.
다음 도메인 각각에 이 단계를 반복합니다. 반복할 때마다 ZONE_NAME 및 DNS_NAME을 해당 도메인에 적절한 값으로 변경합니다. 매번 PROJECT_ID 및 NETWORK_NAME을 동일하게 유지합니다. *.notebooks.googleapis.com에는 이미 이러한 단계를 완료했습니다.
*.notebooks.googleapis.com
*.notebooks.cloud.google.com
*.notebooks.googleusercontent.com
*.googleapis.com: 다른 Google API 및 서비스와 상호작용하는 코드 실행
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-18(UTC)"],[],[],null,["# Use a managed notebooks instance within a service perimeter\n===========================================================\n\n\n| Vertex AI Workbench managed notebooks is\n| [deprecated](/vertex-ai/docs/deprecations). On\n| April 14, 2025, support for\n| managed notebooks will end and the ability to create managed notebooks instances\n| will be removed. Existing instances will continue to function\n| but patches, updates, and upgrades won't be available. To continue using\n| Vertex AI Workbench, we recommend that you\n| [migrate\n| your managed notebooks instances to Vertex AI Workbench instances](/vertex-ai/docs/workbench/managed/migrate-to-instances).\n\n\u003cbr /\u003e\n\nThis page describes how to use VPC Service Controls to set up\na managed notebooks instance within a service perimeter.\n\nBefore you begin\n----------------\n\n1. Read the [Overview of\n VPC Service Controls](/vpc-service-controls/docs/overview).\n\n2. [Create a managed notebooks\n instance](/vertex-ai/docs/workbench/managed/create-instance).\n This instance is not within a service\n perimeter yet.\n\n3. [Create a VPC network](/vpc/docs/create-modify-vpc-networks)\n or use your project's\n [default VPC network](/vpc/docs/vpc#default-network).\n\nCreate and configure the service perimeter\n------------------------------------------\n\nTo create and configure the service perimeter, do the following:\n\n1. [Create a service perimeter using\n VPC Service Controls](/vpc-service-controls/docs/create-service-perimeters).\n This service perimeter protects the Google-managed resources of services\n that you specify. While creating your service perimeter, do the following:\n\n 1. When it's time to add projects to your service perimeter, add the\n project that contains your managed notebooks instance.\n\n 2. When it's time to add services to your service perimeter, add the\n **Notebooks API**.\n\nIf you have created your service perimeter without adding the\nprojects and services you need, see [Managing service\nperimeters](/vpc-service-controls/docs/manage-service-perimeters)\nto learn how to update your service perimeter.\n\nConfigure your DNS entries using Cloud DNS\n------------------------------------------\n\n\nVertex AI Workbench managed notebooks instances use several domains that a\nVirtual Private Cloud network doesn't handle by default.\nTo ensure that your VPC network correctly handles requests sent\nto those domains, use Cloud DNS to add DNS records. For more\ninformation about VPC routes, see [Routes](/vpc/docs/routes).\n\n\nTo create a [managed zone](/dns/docs/zones#create_managed_zones) for\na domain, add a DNS entry that will route the request, and execute\nthe transaction, complete the following steps.\nRepeat these steps for each of [several\ndomains](#domains) that you need to handle requests for, starting\nwith `*.notebooks.googleapis.com`.\n\n\nIn [Cloud Shell](https://console.cloud.google.com?cloudshell=true)\nor any environment where the [Google Cloud CLI](/sdk/docs)\nis installed, enter the following [Google Cloud CLI](/sdk/gcloud) commands.\n\n1.\n To create a private managed zone\n for one of the domains that your\n VPC network needs to handle:\n\n ```bash\n gcloud dns managed-zones create ZONE_NAME \\\n --visibility=private \\\n --networks=https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/NETWORK_NAME \\\n --dns-name=DNS_NAME \\\n --description=\"Description of your managed zone\"\n \n ```\n\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e: a name for the zone to create. You must use a separate zone for each domain. This zone name is used in each of the following steps.\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the ID of the project that hosts your VPC network\n - \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e: the name of the VPC network that you created earlier\n - \u003cvar translate=\"no\"\u003eDNS_NAME\u003c/var\u003e: the part of the domain name that comes after the `*.`, with a period on the end. For example, `*.notebooks.googleapis.com` has a \u003cvar translate=\"no\"\u003eDNS_NAME\u003c/var\u003e of `notebooks.googleapis.com.`\n2.\n Start a transaction.\n\n ```bash\n gcloud dns record-sets transaction start --zone=ZONE_NAME\n \n ```\n3.\n Add the following DNS A record. This reroutes traffic to\n Google's restricted IP addresses.\n\n ```bash\n gcloud dns record-sets transaction add \\\n --name=DNS_NAME. \\\n --type=A 199.36.153.4 199.36.153.5 199.36.153.6 199.36.153.7 \\\n --zone=ZONE_NAME \\\n --ttl=300\n \n ```\n4.\n Add the following DNS CNAME record to point to the A record\n that you just added. This redirects all traffic matching the\n domain to the IP addresses listed in the previous step.\n\n ```bash\n gcloud dns record-sets transaction add \\\n --name=\\*.DNS_NAME. \\\n --type=CNAME DNS_NAME. \\\n --zone=ZONE_NAME \\\n --ttl=300\n \n ```\n5.\n Execute the transaction.\n\n ```bash\n gcloud dns record-sets transaction execute --zone=ZONE_NAME\n \n ```\n6.\n Repeat these steps for each of the following domains. For each\n repetition, change \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e\n and \u003cvar translate=\"no\"\u003eDNS_NAME\u003c/var\u003e to the appropriate values for that\n domain. Keep \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e and \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e\n the same each time. You already\n completed these steps for `*.notebooks.googleapis.com`.\n\n - `*.notebooks.googleapis.com`\n - `*.notebooks.cloud.google.com`\n - `*.notebooks.googleusercontent.com`\n - `*.googleapis.com` to run code that interacts with other Google APIs and services\n\nUse Artifact Registry within your service perimeter\n---------------------------------------------------\n\nIf you want to use Artifact Registry in your service perimeter,\nsee [Configure restricted access for GKE\nprivate clusters](/artifact-registry/docs/gke-private-clusters).\n\nUse Shared VPC\n--------------\n\nIf you are using [Shared VPC](/vpc/docs/shared-vpc),\nyou must add the host and the service projects to the service\nperimeter. In the host project, you must also grant the\n[Compute Network User role](/iam/docs/understanding-roles#predefined)\n(`roles/compute.networkUser`) to the [Notebooks Service\nAgent](/iam/docs/service-agents#cloud-ai-platform-notebooks-service-account)\nfrom the service project. For more information, see [Managing\nservice perimeters](/vpc-service-controls/docs/manage-service-perimeters).\n\nAccess your managed notebooks instance\n--------------------------------------\n\n1. In the Google Cloud console, go to the **Managed notebooks** page.\n\n [Go to Managed notebooks](https://console.cloud.google.com/vertex-ai/workbench/managed)\n2. Next to your managed notebooks instance's name,\n click **Open JupyterLab**.\n\n3. If it's the first time you have accessed the\n managed notebooks instance's JupyterLab user interface,\n you must grant permission to access your data and authenticate\n your managed notebooks instance.\n\n 1. In the **Authenticate your managed notebook** dialog, click the button\n to get an authentication code.\n\n 2. Choose an account and click **Allow**. Copy the authentication code.\n\n 3. In the **Authenticate your managed notebook** dialog,\n paste the authentication code, and then click **Authenticate**.\n\nYour managed notebooks instance opens JupyterLab.\n\nLimitations\n-----------\n\n### Identity type for ingress and egress policies\n\nWhen you specify an ingress or egress policy for a service perimeter,\nyou can't use `ANY_SERVICE_ACCOUNT`\nor `ANY_USER_ACCOUNT` as an identity type for\nall [Vertex AI Workbench](/vertex-ai/docs/workbench)\noperations.\n\nInstead, use `ANY_IDENTITY` as the identity type.\n\n### Accessing the managed notebooks proxy from a workstation without internet\n\nTo access managed notebooks instances\nfrom a workstation with limited internet access,\nverify with your IT administrator that you can access the following domains:\n\n- `*.accounts.google.com`\n- `*.accounts.youtube.com`\n- `*.googleusercontent.com`\n- `*.kernels.googleusercontent.com`\n- `*.gstatic.com`\n- `*.notebooks.cloud.google.com`\n- `*.notebooks.googleapis.com`\n\nYou must have access to these domains for authentication to\nGoogle Cloud. See the previous section,\n[Configure your DNS entries using Cloud DNS](#configure-dns),\nfor further configuration information.\n\nWhat's next\n-----------\n\n- Learn more about [VPC Service Controls](/vpc-service-controls)."]]
