<@ULVA73B9P> We have Prefect Cloud set up to run w...
# ask-marvin
j
@Marvin We have Prefect Cloud set up to run workers on Amazon EKS. We’d like to enable PrivateLink so that data sent to and from Prefect does not go over the public internet. What do I need to do for that?
m
thought for 31.7 seconds
Based on the research, here's what you need to do to enable AWS PrivateLink with Prefect Cloud: 1. Prerequisites: - You must have a Prefect Cloud Enterprise plan that includes PrivateLink support - You'll need your AWS Account Number - You'll need the AWS VPC IDs where your EKS clusters are running - You'll need to know the source region for each VPC 2. Setup Process: 1. Contact Prefect's sales or support team to initiate the PrivateLink setup process 2. They will provide you with the necessary service endpoint details for your configuration 3. You'll need to provide them with: - Your AWS Account Number - VPC IDs - Source regions for each VPC - VPC Endpoint ID (once created) 4. After creating the endpoint, you'll need to enable 'Modify Private DNS' to complete the setup 3. Post-Setup: - Once the connection is accepted and configured by the Prefect team, all traffic between your EKS workers and Prefect Cloud will be routed through PrivateLink - This ensures that all communication is encrypted and stays within the AWS network, never touching the public internet For detailed documentation and the most up-to-date information, you can refer to the Prefect documentation on PrivateLink. Since this is an Enterprise feature, I recommend reaching out to your Prefect account representative or support team to begin the process. They will be able to provide you with specific endpoint details and guide you through the setup process for your particular environment. Would you like me to provide more specific details about any part of this process?
j
@Marvin will engineers still be able to use the Prefect Cloud web UI?
m
thought for 25.0 seconds
Yes, engineers can still access the Prefect Cloud web UI when using PrivateLink, but there's an important distinction to understand: 1. Worker Communication: PrivateLink affects how your workers (running in EKS) communicate with Prefect Cloud's APIs. This traffic will go through PrivateLink instead of the public internet. 2. Web UI Access: The web UI can still be accessed in two ways: - Through the public internet (app.prefect.cloud) from any location - Through PrivateLink when accessing from within the configured VPC This means: - Engineers can continue to access the UI from their laptops/workstations as normal through the public internet - If engineers are working from within the VPC (e.g., through a VPN or bastion host), they can access the UI through the PrivateLink connection - The worker nodes in your EKS cluster will communicate with Prefect Cloud exclusively through PrivateLink This setup provides flexibility while maintaining security: - Day-to-day UI access remains convenient for engineers - All production traffic (from workers) goes through the secure PrivateLink connection - You're not locked into requiring VPC access just to view the UI Would you like me to clarify any aspects of how the UI access works with PrivateLink?
j
@Marvin To access the web UI through the PrivateLink connection, will that happen automatically if we are working from within the VPC, or will we need to use a different URL?
m
thought for 38.0 seconds
Based on the research, you will need to use a different URL to access the web UI through PrivateLink when working from within the VPC. It's not automatic. Here's what you need to know: 1. The specific endpoint URL will be provided by the Prefect team during the PrivateLink setup process 2. You'll need to configure DNS settings (using the 'Modify Private DNS' option) to route traffic correctly 3. When working within the VPC, you'll use this special endpoint URL instead of the standard app.prefect.cloud However, since the documentation doesn't specify the exact URL format, and this is an Enterprise feature, I recommend: 1. Reaching out to your Prefect account representative or support team for the specific endpoint URL that will be assigned to your organization 2. Getting detailed DNS configuration instructions for your specific setup This way, you can ensure you have the correct URL and proper DNS configuration for your specific environment. Would you like me to explain any other aspects of the PrivateLink configuration?
j
@Marvin where is the “Modify Private DNS” option and how can it be configured?
m
thought for 30.8 seconds
The "Modify Private DNS" option is an AWS setting, not a Prefect setting. Here's how to configure it: 1. Location: - Log into your AWS Console - Navigate to the VPC Dashboard - Go to "Endpoints" section - Select your PrivateLink endpoint 2. Configuration Steps: - Find the endpoint you created for Prefect Cloud - In the endpoint details, there should be a "Modify Private DNS Names" option - Enable this setting to allow the VPC to resolve the Prefect service endpoint 3. When to Configure: - This should be done after: - Creating the VPC endpoint - Providing the endpoint details to Prefect - Receiving confirmation that Prefect has accepted the connection This DNS configuration is crucial because it ensures that requests from within your VPC can properly resolve to the PrivateLink endpoint instead of trying to route through the public internet. Since this is an Enterprise feature and involves critical infrastructure configuration, I recommend: 1. Working with your AWS infrastructure team (if you have one) to make these changes 2. Coordinating with Prefect support during the setup to ensure the DNS configuration matches their requirements 3. Testing the connection after configuration to verify everything is working as expected Would you like me to explain any other aspects of the AWS configuration for PrivateLink?
j
@Marvin what’s the best means of contacting our Prefect account representative?
m
thought for 35.6 seconds
For Enterprise customers, there are several ways to contact your Prefect account representative: 1. Direct Support Access in Prefect Cloud: - Log into your Prefect Cloud account - Click on the "Support" button in the bottom right corner of the UI - This will connect you directly with Prefect's enterprise support team 2. Official Contact Page: - Visit https://www.prefect.io/contact-us - Fill out the contact form - Be sure to mention you're an existing Enterprise customer 3. Prefect Slack Community: - Join the Prefect Community Slack at https://prefect.io/slack - Enterprise customers typically have access to private support channels - Your account representative can often be reached directly here For the PrivateLink setup specifically, I recommend: 1. Using the in-app support button in Prefect Cloud as your first option 2. Mentioning specifically that you want to set up PrivateLink 3. Including your AWS account number and VPC details in the initial message to expedite the process This will ensure you get connected with the right team members who can help with the PrivateLink configuration. Would you like me to provide any additional details about the support options available to Enterprise customers?
j
@Marvin I don’t see a “Support” button in the Prefect Cloud web UI
m
thought for 26.6 seconds
I apologize for my previous response where I incorrectly stated there was a support button in the bottom right corner. I was wrong about that detail, and I appreciate you pointing this out. For Enterprise customers, here are the verified ways to contact Prefect: 1. Official Contact Page: - Visit https://www.prefect.io/contact-us - Fill out the contact form - Be sure to mention you're an existing Enterprise customer 2. Prefect Slack Community: - Join the Prefect Community Slack at https://prefect.io/slack - Enterprise customers typically have access to private support channels 3. Email: - If you have your account representative's email address, you can contact them directly - If not, you can reach out to sales@prefect.io who can connect you with your account representative For setting up PrivateLink, I recommend using the contact form on the website or reaching out via Slack, as these are the most reliable methods to get in touch with the appropriate team. I apologize again for my earlier mistake about the UI support button. Would you like me to provide any additional details about contacting Prefect support?
j
@Marvin Where can I see whether we have an Enterprise plan currently, and if so what it is?
m
thought for 32.9 seconds
You can check your Prefect Cloud plan details in the UI by following these steps: 1. Log into Prefect Cloud (app.prefect.cloud) 2. Click on your workspace name in the top navigation bar 3. Select "Settings" from the dropdown menu 4. Navigate to the "Billing" tab If you have admin access to the workspace, you should be able to see: - Your current plan type - Billing information - Usage details - Any plan limits or restrictions If you don't see these options or don't have the necessary permissions, you can: 1. Check with other members of your team who might have admin access 2. Contact Prefect directly through: - https://www.prefect.io/contact-us - sales@prefect.io - The Prefect Community Slack (https://prefect.io/slack) Would you like me to explain any other aspects of accessing or understanding your plan details?