DOC-1435 Add gcloud commands for firewall rules for PSC consumer #377
Conversation
✅ Deploy Preview for rp-cloud ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the 📝 WalkthroughWalkthroughThis set of changes primarily restructures and expands documentation related to Iceberg catalog integrations and GCP Private Service Connect (PSC) in Redpanda Cloud. The "Iceberg" documentation navigation is reorganized to introduce a REST catalog grouping, with new pages for AWS Glue, Databricks Unity Catalog, and Snowflake/Open Catalog, and corresponding navigation updates. Several networking documentation files are extensively revised to provide detailed, step-by-step instructions for configuring PSC via both UI and API, clarify terminology, update placeholders and command examples, and add new sections on disabling PSC. Some redundant or outdated partial documentation files are removed or consolidated. Sequence Diagram(s)sequenceDiagram
participant User
participant Redpanda Cloud UI
participant GCP (gcloud CLI)
participant Redpanda Cluster
User->>Redpanda Cloud UI: Initiate PSC configuration
Redpanda Cloud UI->>User: Provide Service Attachment and DNS info
User->>GCP (gcloud CLI): Create PSC IP, forwarding rule, firewall (EGRESS)
User->>GCP (gcloud CLI): Create private DNS zone and record
User->>Redpanda Cloud UI: Update accepted consumer projects
Redpanda Cloud UI->>Redpanda Cluster: Enable PSC
Note over User,Redpanda Cluster: User can now access Redpanda via PSC endpoint
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~15–25 minutes Assessment against linked issues
Assessment against linked issues: Out-of-scope changes
Possibly related PRs
Suggested reviewers
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
* Add Glue pages to Cloud * Sync with docs main * Use docs branch with updated Cloud-specific guidance * Apply suggestion from PM review * Add What's New entry * Auth configs still need to be allowlisted for 25.1 in Cloud * Update local-antora-playbook.yml
modules/networking/pages/configure-private-service-connect-in-cloud-ui.adoc
Outdated
Show resolved
Hide resolved
modules/networking/pages/configure-private-service-connect-in-cloud-ui.adoc
Outdated
Show resolved
Hide resolved
modules/networking/pages/configure-private-service-connect-in-cloud-ui.adoc
Outdated
Show resolved
Hide resolved
modules/networking/pages/configure-private-service-connect-in-cloud-ui.adoc
Outdated
Show resolved
Hide resolved
|
At https://deploy-preview-377--rp-cloud.netlify.app/redpanda-cloud/networking/gcp-private-service-connect/#enable-private-service-connect-on-an-existing-byoc-or-byovpc-cluster, Step 3 ( The rest LGTM. Thank you @micheleRP |
…s-for-PSC-consumer' of github.com:redpanda-data/cloud-docs into DOC-1435-Add-gcloud-commands-for-creating-firewall-rules-for-PSC-consumer
Thanks @paulzhang97! I moved this into the BYOVPC section: https://deploy-preview-377--rp-cloud.netlify.app/redpanda-cloud/networking/gcp-private-service-connect/#enable-private-service-connect-on-an-existing-byoc-or-byovpc-cluster |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🔭 Outside diff range comments (2)
modules/networking/pages/dedicated/gcp/configure-psc-in-api.adoc (1)
80-84: Trailing comma breaks JSON inCLUSTER_POST_BODY
The comma after the closing brace of"gcp_private_service_connect"makes the example invalid JSON because no further fields follow.- "consumer_accept_list": <consumer-accept-list> - }, + "consumer_accept_list": <consumer-accept-list> + }modules/networking/pages/gcp-private-service-connect.adoc (1)
131-139: Trailing comma insidecustomer_managed_resources.gcpblock
"tiered_storage_bucket"is the last key in the object but is followed by a comma, rendering the JSON invalid.- "tiered_storage_bucket": { "name" : "<byovpc-tiered-storage-bucket>" }, + "tiered_storage_bucket": { "name" : "<byovpc-tiered-storage-bucket>" }
🧹 Nitpick comments (4)
modules/manage/pages/iceberg/rest-catalog/index.adoc (1)
1-3: Index page is empty – readers get no guidance.The file defines only metadata. Consider adding a short introductory paragraph (even two‐three sentences) that explains what a “REST Catalog” is and links out to the child pages. This prevents a blank page or an abrupt jump in navigation.
modules/networking/partials/psc-api.adoc (1)
24-26: Add region-scope requirement for consumer VPC
The UI-based guide explicitly states that the consumer VPC network must be in the same region as the cluster, but this prerequisite is missing here. Readers following only the API guide may overlook the limitation and create endpoints in the wrong region.modules/networking/pages/gcp-private-service-connect.adoc (1)
25-30: Minor formatting glitch in subnet command
The back-slash after--range=<psc-nat-subnet-range>is preceded by no whitespace, which can cause AsciiDoc rendering issues in some themes.- --range=<psc-nat-subnet-range>\ + --range=<psc-nat-subnet-range> \modules/networking/pages/dedicated/gcp/configure-psc-in-ui.adoc (1)
8-10: Avoid hard-coding time-sensitive wording
“(available March, 2025)” will age quickly and require future edits. Prefer a relative phrasing such as “introduced in March 2025” or omit the date entirely.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (12)
modules/ROOT/nav.adoc(1 hunks)modules/get-started/pages/whats-new-cloud.adoc(1 hunks)modules/manage/pages/iceberg/iceberg-topics-aws-glue.adoc(1 hunks)modules/manage/pages/iceberg/rest-catalog/index.adoc(1 hunks)modules/networking/pages/configure-private-service-connect-in-cloud-ui.adoc(1 hunks)modules/networking/pages/dedicated/gcp/configure-psc-in-api.adoc(6 hunks)modules/networking/pages/dedicated/gcp/configure-psc-in-ui.adoc(1 hunks)modules/networking/pages/gcp-private-service-connect.adoc(11 hunks)modules/networking/partials/psc-api.adoc(1 hunks)modules/networking/partials/psc-api2.adoc(0 hunks)modules/networking/partials/psc-ui.adoc(1 hunks)modules/reference/pages/properties/cluster-properties.adoc(1 hunks)
💤 Files with no reviewable changes (1)
- modules/networking/partials/psc-api2.adoc
🧰 Additional context used
🧠 Learnings (10)
📓 Common learnings
Learnt from: micheleRP
PR: redpanda-data/cloud-docs#361
File: modules/networking/pages/cloud-security-network.adoc:193-196
Timestamp: 2025-07-21T21:53:37.731Z
Learning: In Redpanda Cloud documentation, field names and labels should match exactly what appears in the UI, even if the terminology might seem technically inconsistent. For example, the NAT gateway IP address field is labeled "Internet gateway" in the UI, so documentation should use "Internet gateway" to help users locate the correct field.
Learnt from: micheleRP
PR: redpanda-data/cloud-docs#361
File: modules/networking/pages/cloud-security-network.adoc:176-179
Timestamp: 2025-07-21T21:52:17.061Z
Learning: In Redpanda Cloud documentation, BYOVPC and BYOVNet are different product names for different cloud providers: BYOVPC is used for AWS and GCP, while BYOVNet is used for Azure. When documentation sections cover multiple cloud providers, the combined notation "BYOVPC/BYOVNet" is correct and should not be changed to use only one term.
Learnt from: micheleRP
PR: redpanda-data/cloud-docs#267
File: modules/manage/pages/maintenance.adoc:91-92
Timestamp: 2025-04-25T01:41:57.162Z
Learning: The notification timeline for Redpanda Cloud deprecations has been deliberately removed from the documentation, even though the PR summary mentioned a 180-day advance notice period.
Learnt from: micheleRP
PR: redpanda-data/cloud-docs#267
File: modules/manage/pages/maintenance.adoc:63-64
Timestamp: 2025-04-25T01:42:09.318Z
Learning: The timeline for major upgrade notifications (180 days in advance) was intentionally removed from the Redpanda Cloud maintenance documentation, even though it was mentioned in the PR objectives.
Learnt from: asimms41
PR: redpanda-data/cloud-docs#291
File: modules/develop/pages/connect/components/processors/google_drive_download.adoc:1-1
Timestamp: 2025-05-13T13:20:39.044Z
Learning: In Redpanda Cloud documentation, component titles (particularly processors) follow a standard naming convention that uses underscores (like "google_drive_download") rather than human-readable titles. This convention should be maintained for consistency across all component documentation.
📚 Learning: in redpanda cloud documentation, field names and labels should match exactly what appears in the ui,...
Learnt from: micheleRP
PR: redpanda-data/cloud-docs#361
File: modules/networking/pages/cloud-security-network.adoc:193-196
Timestamp: 2025-07-21T21:53:37.731Z
Learning: In Redpanda Cloud documentation, field names and labels should match exactly what appears in the UI, even if the terminology might seem technically inconsistent. For example, the NAT gateway IP address field is labeled "Internet gateway" in the UI, so documentation should use "Internet gateway" to help users locate the correct field.
Applied to files:
modules/networking/pages/gcp-private-service-connect.adocmodules/networking/pages/configure-private-service-connect-in-cloud-ui.adocmodules/networking/partials/psc-ui.adocmodules/networking/pages/dedicated/gcp/configure-psc-in-api.adocmodules/get-started/pages/whats-new-cloud.adocmodules/networking/partials/psc-api.adocmodules/networking/pages/dedicated/gcp/configure-psc-in-ui.adoc
📚 Learning: in redpanda cloud documentation, byovpc and byovnet are different product names for different cloud ...
Learnt from: micheleRP
PR: redpanda-data/cloud-docs#361
File: modules/networking/pages/cloud-security-network.adoc:176-179
Timestamp: 2025-07-21T21:52:17.061Z
Learning: In Redpanda Cloud documentation, BYOVPC and BYOVNet are different product names for different cloud providers: BYOVPC is used for AWS and GCP, while BYOVNet is used for Azure. When documentation sections cover multiple cloud providers, the combined notation "BYOVPC/BYOVNet" is correct and should not be changed to use only one term.
Applied to files:
modules/networking/pages/gcp-private-service-connect.adocmodules/networking/pages/configure-private-service-connect-in-cloud-ui.adocmodules/networking/partials/psc-ui.adocmodules/networking/pages/dedicated/gcp/configure-psc-in-api.adocmodules/networking/partials/psc-api.adocmodules/networking/pages/dedicated/gcp/configure-psc-in-ui.adoc
📚 Learning: in the redpanda cloud documentation system, cross-reference anchors using the format `#patch-/v1/clu...
Learnt from: micheleRP
PR: redpanda-data/cloud-docs#334
File: modules/networking/partials/psc-api2.adoc:15-16
Timestamp: 2025-06-18T21:02:38.074Z
Learning: In the Redpanda Cloud documentation system, cross-reference anchors using the format `#patch-/v1/clusters/-cluster.id-` work correctly for referencing API endpoints, even with dashes instead of curly braces around parameter names.
Applied to files:
modules/networking/pages/gcp-private-service-connect.adocmodules/networking/pages/dedicated/gcp/configure-psc-in-api.adocmodules/networking/partials/psc-api.adoc
📚 Learning: in redpanda cloud documentation, component titles (particularly processors) follow a standard naming...
Learnt from: asimms41
PR: redpanda-data/cloud-docs#291
File: modules/develop/pages/connect/components/processors/google_drive_download.adoc:1-1
Timestamp: 2025-05-13T13:20:39.044Z
Learning: In Redpanda Cloud documentation, component titles (particularly processors) follow a standard naming convention that uses underscores (like "google_drive_download") rather than human-readable titles. This convention should be maintained for consistency across all component documentation.
Applied to files:
modules/networking/pages/gcp-private-service-connect.adocmodules/networking/partials/psc-api.adoc
📚 Learning: user david-yu indicated that the standard azure zones format using plain numbers like "1", "2", "3" ...
Learnt from: david-yu
PR: redpanda-data/cloud-docs#338
File: modules/get-started/pages/cluster-types/byoc/azure/vnet-azure.adoc:74-75
Timestamp: 2025-06-24T03:31:29.345Z
Learning: User david-yu indicated that the standard Azure zones format using plain numbers like "1", "2", "3" is not valid for their specific Azure BYOVNet setup, suggesting there may be specific tooling or API requirements that expect region-prefixed zone names like "centralus-az1".
Applied to files:
modules/networking/pages/gcp-private-service-connect.adoc
📚 Learning: the notification timeline for redpanda cloud deprecations has been deliberately removed from the doc...
Learnt from: micheleRP
PR: redpanda-data/cloud-docs#267
File: modules/manage/pages/maintenance.adoc:91-92
Timestamp: 2025-04-25T01:41:57.162Z
Learning: The notification timeline for Redpanda Cloud deprecations has been deliberately removed from the documentation, even though the PR summary mentioned a 180-day advance notice period.
Applied to files:
modules/networking/pages/configure-private-service-connect-in-cloud-ui.adocmodules/networking/partials/psc-ui.adocmodules/networking/pages/dedicated/gcp/configure-psc-in-api.adocmodules/get-started/pages/whats-new-cloud.adocmodules/networking/partials/psc-api.adocmodules/networking/pages/dedicated/gcp/configure-psc-in-ui.adoc
📚 Learning: the timeline for major upgrade notifications (180 days in advance) was intentionally removed from th...
Learnt from: micheleRP
PR: redpanda-data/cloud-docs#267
File: modules/manage/pages/maintenance.adoc:63-64
Timestamp: 2025-04-25T01:42:09.318Z
Learning: The timeline for major upgrade notifications (180 days in advance) was intentionally removed from the Redpanda Cloud maintenance documentation, even though it was mentioned in the PR objectives.
Applied to files:
modules/networking/partials/psc-ui.adocmodules/get-started/pages/whats-new-cloud.adocmodules/networking/pages/dedicated/gcp/configure-psc-in-ui.adoc
📚 Learning: in the redpanda cloud documentation system using asciidoctor, glossary cross-references with spaces ...
Learnt from: micheleRP
PR: redpanda-data/cloud-docs#350
File: modules/get-started/pages/cloud-overview.adoc:55-56
Timestamp: 2025-07-16T21:11:59.964Z
Learning: In the Redpanda Cloud documentation system using Asciidoctor, glossary cross-references with spaces in the ID (like `glossterm:data plane[]`) work correctly and do not need to be changed to hyphenated forms. The existing syntax is functional and should not be modified.
Applied to files:
modules/get-started/pages/whats-new-cloud.adocmodules/networking/partials/psc-api.adoc
📚 Learning: in the redpanda cloud documentation system using asciidoctor, glossary cross-references with leading...
Learnt from: micheleRP
PR: redpanda-data/cloud-docs#370
File: modules/security/pages/cloud-authentication.adoc:74-76
Timestamp: 2025-08-01T16:53:12.919Z
Learning: In the Redpanda Cloud documentation system using Asciidoctor, glossary cross-references with leading commas in the attribute list (like `glossterm:ACL[,access control lists (ACLs)]`) work correctly and should not be modified. The leading comma syntax is intentional and functional.
Applied to files:
modules/networking/partials/psc-api.adoc
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Redirect rules - rp-cloud
- GitHub Check: Header rules - rp-cloud
- GitHub Check: Pages changed - rp-cloud
🔇 Additional comments (7)
modules/reference/pages/properties/cluster-properties.adoc (1)
11-11: Confirm that property tag rename is reflected everywhere.
iceberg_rest_catalog_prefixwas replaced byiceberg_rest_catalog_warehouse. Please double-check that:
- The corresponding property name in the product was really renamed.
- All existing docs, examples, and configuration snippets were updated accordingly.
A stale tag here will break Antora’s include processing and surface as broken references.
modules/get-started/pages/whats-new-cloud.adoc (1)
10-17: Nice concise announcement.The new “Iceberg topics with AWS Glue” entry reads clearly, links correctly, and matches naming conventions. No issues spotted.
modules/ROOT/nav.adoc (1)
418-422: Navigation update looks consistent.The new rest-catalog subsection and child entries are wired correctly and alphabetically placed. Good job keeping the nav coherent.
modules/networking/pages/dedicated/gcp/configure-psc-in-api.adoc (1)
143-162: Disable section LGTM – clear, syntactically correct example and mirrors the enable flow.modules/networking/partials/psc-ui.adoc (2)
14-15: Verify--addressesflag usage
gcloud compute addresses createusually requires either no--addresses(auto-assign) or--addresses=<IP>only for internal reserved addresses. Please confirm this flag combination is accepted for your scenario.
28-34: Port list inconsistency (30081 vs 30181)
Ingress rules elsewhere use30181, whereas the egress rule here lists30081. Double-check which port is correct for consumer access to HTTP Proxy to avoid unreachable service.modules/networking/pages/configure-private-service-connect-in-cloud-ui.adoc (1)
53-61: Ingress rule looks good and matches producer-side spec – naming, ranges, and CIDR sources are consistent with prior conventions.
modules/networking/pages/dedicated/gcp/configure-psc-in-ui.adoc
Outdated
Show resolved
Hide resolved
modules/networking/pages/dedicated/gcp/configure-psc-in-ui.adoc
Outdated
Show resolved
Hide resolved
| --target-tags="redpanda-node" \ | ||
| --source-ranges="10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,100.64.0.0/10" \ | ||
| --allow="tcp:30181,tcp:30282,tcp:30292,tcp:31004,tcp:31082-31101,tcp:31182-31201,tcp:31282-31301,tcp:32092-32111,tcp:32192-32211,tcp:32292-32311" |
There was a problem hiding this comment.
are these fixed? if no, we should add them as replaceable snippet and provide these values as an example.
micheleRP
deleted the
DOC-1435-Add-gcloud-commands-for-creating-firewall-rules-for-PSC-consumer
branch
Description
This pull request updates the documentation for configuring GCP Private Service Connect.
Step-by-Step Setup Enhancements:
gcloudCLI commands.gcloudcommands for creating private DNS zones and wildcard DNS records, improving reproducibility.Firewall and Resource Naming:
redpanda-psc-ingressandredpanda-psc-egress) and clarified which networks and resources are involved.Placeholder and Variable Naming:
Terminology and Clarity:
psc-api2.adoc), consolidating disable instructions and ensuring all guides point to the correct, updated partials. [1] [2] [3]consumer_accept_list).Resolves https://redpandadata.atlassian.net/browse/DOC-1435
Resolves https://redpandadata.atlassian.net/browse/DOC-1136
Resolves https://redpandadata.atlassian.net/browse/DOC-1489
Review deadline:
Page previews
Configure PSC with UI: BYOC
Configure PSC with API:BYOC
Configure PSC with UI: Dedicated
Configure PSC with API: Dedicated
Checks