Back to Details

gke-networking

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

GKE Networking

GKE 网络配置

This reference covers networking configuration for GKE clusters. The golden path enforces private, VPC-native clusters with Dataplane V2.
MCP Tools: 
get_cluster
, 
update_cluster
, 
apply_k8s_manifest
, 
get_k8s_resource
本参考文档涵盖GKE集群的网络配置。推荐路径强制使用私有、VPC原生且搭载Dataplane V2的集群。
MCP 工具： 
get_cluster
, 
update_cluster
, 
apply_k8s_manifest
, 
get_k8s_resource

Golden Path Networking Defaults

推荐路径网络默认配置

SettingGolden Path ValueDay-0/1Notes
privateClusterConfig.enablePrivateNodes
true
Day-0Nodes have no public IPs
masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled
true
Day-0Control plane only reachable via private endpoint or DNS
controlPlaneEndpointsConfig.dnsEndpointConfig.allowExternalTraffic
true
Day-0Allows DNS-based access from outside VPC
networkConfig.datapathProvider
ADVANCED_DATAPATH
(Dataplane V2)		Day-0eBPF-based, built-in Network Policy
networkConfig.dnsConfig.clusterDns
CLOUD_DNS
Day-0Managed DNS, more reliable than kube-dns
networkConfig.enableIntraNodeVisibility
true
Day-1VPC Flow Logs for intra-node traffic
networkConfig.gatewayApiConfig.channel
CHANNEL_STANDARD
Day-1Gateway API support
ipAllocationPolicy.autoIpamConfig.enabled
true
Day-0Automatic IP range management
ipAllocationPolicy.createSubnetwork
true
Day-0Auto-create dedicated subnet
defaultMaxPodsConstraint.maxPodsPerNode
48
Day-0Conservative default; 110 for high density
设置项推荐路径值阶段（Day-0/1）说明
privateClusterConfig.enablePrivateNodes
true
Day-0节点无公网IP
masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled
true
Day-0控制平面仅可通过私有端点或DNS访问
controlPlaneEndpointsConfig.dnsEndpointConfig.allowExternalTraffic
true
Day-0允许从VPC外部通过DNS方式访问
networkConfig.datapathProvider
ADVANCED_DATAPATH
（Dataplane V2）		Day-0基于eBPF，内置Network Policy
networkConfig.dnsConfig.clusterDns
CLOUD_DNS
Day-0托管式DNS，比kube-dns更可靠
networkConfig.enableIntraNodeVisibility
true
Day-1节点内流量的VPC流日志
networkConfig.gatewayApiConfig.channel
CHANNEL_STANDARD
Day-1支持Gateway API
ipAllocationPolicy.autoIpamConfig.enabled
true
Day-0自动IP范围管理
ipAllocationPolicy.createSubnetwork
true
Day-0自动创建专用子网
defaultMaxPodsConstraint.maxPodsPerNode
48
Day-0保守默认值；高密度场景可设为110

Private Cluster Access Patterns

私有集群访问模式

The golden path creates a private cluster. Users access it via:
  1. DNS endpoint (default): 
    allowExternalTraffic: true
    enables access via the cluster's DNS endpoint from outside the VPC. No VPN required.
  2. Private endpoint: Direct access from within the VPC or via Cloud VPN/Interconnect.
  3. Authorized networks: Add specific CIDRs to 
    masterAuthorizedNetworksConfig
    for IP-based access control.
bash
undefined
推荐路径创建的是私有集群，用户可通过以下方式访问：
  1. DNS端点（默认）：
    allowExternalTraffic: true
    允许从VPC外部通过集群的DNS端点访问，无需VPN。
  2. 私有端点：从VPC内部或通过Cloud VPN/Interconnect直接访问。
  3. 授权网络：向
    masterAuthorizedNetworksConfig
    添加特定CIDR，实现基于IP的访问控制。
bash
undefined

Access private cluster via DNS endpoint (golden path default)

Access private cluster via DNS endpoint (golden path default)

gcloud container clusters get-credentials <CLUSTER_NAME>
--region <REGION> --dns-endpoint
--quiet
gcloud container clusters get-credentials <CLUSTER_NAME>
--region <REGION> --dns-endpoint
--quiet

Access via private endpoint (from within VPC)

Access via private endpoint (from within VPC)

gcloud container clusters get-credentials <CLUSTER_NAME>
--region <REGION> --internal-ip
--quiet
undefined
gcloud container clusters get-credentials <CLUSTER_NAME>
--region <REGION> --internal-ip
--quiet
undefined

Bring-Your-Own VPC/Subnet

自定义VPC/子网（Bring-Your-Own VPC/Subnet）

If the customer has existing network infrastructure:
bash
gcloud container clusters create-auto <CLUSTER_NAME> \
  --region <REGION> \
  --network <VPC_NAME> \
  --subnetwork <SUBNET_NAME> \
  --cluster-secondary-range-name <POD_RANGE> \
  --services-secondary-range-name <SVC_RANGE> \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --quiet
Day-0 Warning: VPC, subnet, and IP ranges cannot be changed after cluster creation.
如果客户已有网络基础设施：
bash
gcloud container clusters create-auto <CLUSTER_NAME> \
  --region <REGION> \
  --network <VPC_NAME> \
  --subnetwork <SUBNET_NAME> \
  --cluster-secondary-range-name <POD_RANGE> \
  --services-secondary-range-name <SVC_RANGE> \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --quiet
Day-0 警告：集群创建后，VPC、子网和IP范围无法修改。

IP Planning

IP规划

ResourceGolden PathNotes
Pod CIDR
/17
(auto)		~32K pod IPs; size based on maxPodsPerNode
Service CIDR
/20
(auto)		~4K service IPs
Node subnetauto-created/20 recommended for growth
Max pods/node48Each node gets a /25 pod range; set to 110
: : : for /24 per node :
Pod CIDR sizing rule of thumb:
  • maxPodsPerNode=48
    -> each node uses a 
    /25
    (128 IPs) from pod CIDR
  • maxPodsPerNode=110
    -> each node uses a 
    /24
    (256 IPs) from pod CIDR
  • Larger maxPodsPerNode = fewer nodes fit in a given CIDR
资源类型推荐路径配置说明
Pod CIDR
/17
（自动）		约32K个Pod IP；大小基于maxPodsPerNode配置
Service CIDR
/20
（自动）		约4K个服务IP
节点子网自动创建推荐使用/20以预留扩容空间
单节点最大Pod数48每个节点分配/25的Pod范围；若设为110则分配/24范围
Pod CIDR大小估算准则：
  • maxPodsPerNode=48
    -> 每个节点从Pod CIDR中使用
    /25
    （128个IP）
  • maxPodsPerNode=110
    -> 每个节点从Pod CIDR中使用
    /24
    （256个IP）
  • 单节点最大Pod数越大，给定CIDR可容纳的节点数越少

Ingress

入口（Ingress）

Gateway API (golden path, enabled via 
gatewayApiConfig.channel: CHANNEL_STANDARD
):
yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: external-http
spec:
  gatewayClassName: gke-l7-global-external-managed
  listeners:
  - name: http
    protocol: HTTP
    port: 80
Alternatives:
  • gke-l7-regional-external-managed
    — regional external
  • gke-l7-rilb
    — internal load balancer
  • Istio service mesh — for advanced traffic management, mTLS
Gateway API（推荐路径，通过
gatewayApiConfig.channel:CHANNEL_STANDARD
启用）：
yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: external-http
spec:
  gatewayClassName: gke-l7-global-external-managed
  listeners:
  - name: http
    protocol: HTTP
    port: 80
替代方案：
  • gke-l7-regional-external-managed
    — 区域型外部负载均衡器
  • gke-l7-rilb
    — 内部负载均衡器
  • Istio服务网格 — 用于高级流量管理、mTLS

Egress

出口（Egress）

  • Default: nodes use Cloud NAT for outbound internet access (private nodes have no public IPs)
  • For static egress IPs: configure Cloud NAT with manual IP allocation
  • For restricted egress: route through a firewall appliance via custom routes
  • 默认：节点通过Cloud NAT访问外部互联网（私有节点无公网IP）
  • 静态出口IP：配置Cloud NAT并手动分配IP
  • 受限出口：通过自定义路由将流量导向防火墙设备

Network Policy

Network Policy

Dataplane V2 (golden path) provides built-in Network Policy enforcement — no additional addon needed. Apply default-deny per namespace, then allow specific flows.
See the 
gke-security
skill for default-deny policy and the 
gke-multitenancy
skill for per-team allow policies.
Dataplane V2（推荐路径）提供内置的Network Policy enforcement——无需额外插件。为每个命名空间应用默认拒绝策略，再允许特定流量。
关于默认拒绝策略，请参考
gke-security
技能；关于按团队设置允许策略，请参考
gke-multitenancy
技能。

Cloud Armor (Recommended for Public-Facing Services)

Cloud Armor（面向公网服务推荐）

Cloud Armor provides WAF and DDoS protection. Not a golden path default — recommended for any service with public ingress. Link via 
BackendConfig
:
yaml
undefined
Cloud Armor提供WAF和DDoS防护。并非推荐路径默认配置——建议所有带有公网入口的服务使用。通过
BackendConfig
关联：
yaml
undefined

1. Create BackendConfig referencing your Cloud Armor policy

1. Create BackendConfig referencing your Cloud Armor policy

apiVersion: cloud.google.com/v1 kind: BackendConfig metadata: name: my-backend-config spec: securityPolicy: name: my-cloud-armor-policy

apiVersion: cloud.google.com/v1 kind: BackendConfig metadata: name: my-backend-config spec: securityPolicy: name: my-cloud-armor-policy

2. Annotate your Service

2. Annotate your Service

cloud.google.com/backend-config: '{"default": "my-backend-config"}'

cloud.google.com/backend-config: '{"default": "my-backend-config"}'

undefined
undefined

SSL, Container-Native LB, and PSC

SSL、容器原生负载均衡（Container-Native LB）和PSC

  • Google-managed SSL certificates: Use 
    ManagedCertificate
    CRD with Gateway API. Auto-provisions and renews.
  • Container-native LB: Enabled by default on VPC-native clusters (golden path). Targets pods via NEGs, bypassing iptables. Annotation: 
    cloud.google.com/neg: '{"ingress": true}'
    .
  • Private Service Connect (PSC): Use 
    ServiceAttachment
    CRD to expose services across VPCs without peering.
  • 谷歌托管SSL证书：结合Gateway API使用
    ManagedCertificate
    CRD，自动颁发和续期。
  • 容器原生负载均衡：在VPC原生集群（推荐路径）中默认启用。通过NEG直接指向Pod，绕过iptables。注解：
    cloud.google.com/neg: '{"ingress": true}'
    。
  • Private Service Connect (PSC)：使用
    ServiceAttachment
    CRD跨VPC暴露服务，无需对等连接。