Skip to content

Allow alternative services for private-service-access#4477

Merged
samskillman merged 7 commits into
GoogleCloudPlatform:developfrom
okrause:gcnv-integration
Aug 28, 2025
Merged

Allow alternative services for private-service-access#4477
samskillman merged 7 commits into
GoogleCloudPlatform:developfrom
okrause:gcnv-integration

Conversation

@okrause
Copy link
Copy Markdown
Contributor

@okrause okrause commented Aug 1, 2025

Most Google services which utilise Private Service Access (PSA) use the servicenetworking peering.

Google Cloud NetApp Volumes (GCNV) is a Google file service for scalable NFS and SMB remote filesystems. I am planning to add better support for GCNV to cluster toolkit. This PR is a small change which allows to connect their network to GCNV.

GCNV uses PSA with a different PSA service name. So far, the module hardcoded servicenetworking.googleapis.com as the service to peer. This change changes the hardcoding into a variable, which defaults to servicenetworking.googleapis.com.

This allows users to specify a different peering service like netapp.servicenetworking.goog without breaking backward compatibility. It also adds an example.

Additionally, it proposes a few small cleanups in variable descriptions.

@okrause okrause requested review from a team and samskillman as code owners August 1, 2025 13:36
@okrause
Copy link
Copy Markdown
Contributor Author

okrause commented Aug 13, 2025

Hello! I am a with the Google Cloud NetApp Volume (GCNV) team and are working on integrating GCNV as a new NFS file-system into ClusterToolkit. My PoC is already running pretty fine, just needs a few finishing touches and a lot of documentation.

This is my first micro PR to get acquainted with the contribution process and introduce myself. The PR make a static into an variable which defaults to the old static value. User can now specify an alternative value. I am using it successfully for over a week now.

Example code:

...
deployment_groups:
- group: primary
  modules:
  # Source is an embedded module, denoted by "modules/*" without ./, ../, /
  # as a prefix. To refer to a local module, prefix with ./, ../ or /
  - id: network
    source: modules/network/vpc
    settings:
      network_name: $(vars.network)
      region: $(vars.region)

  - id: private_service_access
    source: community/modules/network/private-service-access
    use: [network]
    settings:
      prefix_length: 24
      service_name: "netapp.servicenetworking.goog"
...

Only issue is the destroy behaviour:

Error: Unable to remove Service Networking Connection, err: Error waiting for Delete Service Networking Connection: Error code 9, message: Failed to delete connection; Producer services (e.g. CloudSQL, Cloud Memstore, etc.) are still using this connection.

But that's not related to the my change, but to the fact that GCNV releases the peering lazily. I have seen the same PSA behaviour with CloudSQL. service_networking_connection offers the deletion_policy parameter to workaround such issues. I can add that parameter to this module too as variable, if requested.

What do you think?

Copy link
Copy Markdown
Collaborator

@samskillman samskillman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this contribution!

I do think incorporating the deletion policy would be a good addition here.

For this, pr, i'm going to add a label so that it gets categorized correctly in the release notes.

@samskillman samskillman self-assigned this Aug 20, 2025
@samskillman samskillman added the release-improvements Added to release notes under the "Improvements" heading. label Aug 20, 2025
@okrause
Copy link
Copy Markdown
Contributor Author

okrause commented Aug 22, 2025

Thank you for the feedback. I did a few additional changes and will update the PR after doing some testing.

@okrause
Copy link
Copy Markdown
Contributor Author

okrause commented Aug 25, 2025

Hello @samskillman, I added support for deletion_policy, added documentation and made sure the pre-commit hocks work fine.
I tested both the traditional workflow with servicenetworking and the new one for GCNV.

Please have a look. I plan to PR changes to add support for modules/file-system/netapp-storage-pool and modules/file-system/netapp-volume by the end of the week. Code is running fine. I need to add proper documentation and provide a baseline blueprint which provides shared filesystem(s) which can be used by other blueprints.

Copy link
Copy Markdown
Collaborator

@samskillman samskillman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@samskillman
Copy link
Copy Markdown
Collaborator

Adding @bytetwin as a second reviewer, which is required in this case.

@okrause
Copy link
Copy Markdown
Contributor Author

okrause commented Aug 27, 2025

@bytetwin Hello, I have more PRs queued up which build on top of this one. I am hesitant to PR them while this is still "in the air". Will you find time to look at this soon or should I PR my other changes anyway? They will include this one too, but I am for small PRs to make them small and contained. Please advise.

Copy link
Copy Markdown
Collaborator

@bytetwin bytetwin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@okrause
Copy link
Copy Markdown
Contributor Author

okrause commented Aug 28, 2025

/gcbrun

1 similar comment
@samskillman
Copy link
Copy Markdown
Collaborator

/gcbrun

@samskillman samskillman merged commit 8298f82 into GoogleCloudPlatform:develop Aug 28, 2025
12 of 64 checks passed
@okrause okrause deleted the gcnv-integration branch August 29, 2025 07:59
@okrause
Copy link
Copy Markdown
Contributor Author

okrause commented Aug 29, 2025

Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release-improvements Added to release notes under the "Improvements" heading.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants