gke-service-networking

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

GKE Service Networking Skill

GKE服务网络Skill

This skill provides workflows for exposing applications running on GKE securely to the internet or internal networks.

本Skill提供了将GKE上运行的应用安全暴露到互联网或内部网络的工作流。

Workflows

工作流

1. Configure Gateway API (Recommended)

1. 配置Gateway API（推荐）

The Gateway API is the modern way to manage routing in Kubernetes.

Prerequisites: Gateway API must be enabled on the cluster (enabled by default in GKE 1.24+).

Example Gateway Manifest:

yaml

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: {gateway_name}
  namespace: {namespace}
spec:
  gatewayClassName: gke-l7-global-external-managed # GKE managed external L7 load balancer
  listeners:
    - name: http
      protocol: HTTP
      port: 80

Example HTTPRoute Manifest:

yaml

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {route_name}
  namespace: {namespace}
spec:
  parentRefs:
    - name: {gateway_name}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: {service_name}
          port: 80

Gateway API是Kubernetes中管理路由的现代化方式。

前提条件：集群上必须启用Gateway API（GKE 1.24+版本默认启用）。

示例Gateway清单：

yaml

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: {gateway_name}
  namespace: {namespace}
spec:
  gatewayClassName: gke-l7-global-external-managed # GKE托管的外部L7负载均衡器
  listeners:
    - name: http
      protocol: HTTP
      port: 80

示例HTTPRoute清单：

yaml

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {route_name}
  namespace: {namespace}
spec:
  parentRefs:
    - name: {gateway_name}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: {service_name}
          port: 80

2. Configure Standard GKE Ingress

2. 配置标准GKE Ingress

Use standard Ingress for simpler use cases or legacy setups.

Example Ingress Manifest:

yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {ingress_name}
  namespace: {namespace}
  annotations:
    kubernetes.io/ingress.class: "gce"
spec:
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {service_name}
                port:
                  number: 80

对于较简单的场景或遗留架构，可使用标准Ingress。

示例Ingress清单：

yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {ingress_name}
  namespace: {namespace}
  annotations:
    kubernetes.io/ingress.class: "gce"
spec:
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {service_name}
                port:
                  number: 80

3. Secure with Cloud Armor

3. 借助Cloud Armor实现安全防护

Cloud Armor provides WAF and DDoS protection.

Enable Cloud Armor via BackendConfig:

Create a Security Policy in Cloud Armor (usually via gcloud or Terraform).
Reference it in a
```
BackendConfig
```
in GKE.

Example BackendConfig:

yaml

apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: {backend_config_name}
  namespace: {namespace}
spec:
  securityPolicy:
    name: {security_policy_name}

Associate

BackendConfig

with your

Service

via annotations:

yaml

# In your Kubernetes Service manifest metadata.annotations:
cloud.google.com/backend-config: '{"default": "{backend_config_name}"}'
# Or for specific port mappings:
cloud.google.com/backend-config: '{"ports": {"80": "{backend_config_name}"}}'

Cloud Armor提供WAF和DDoS防护功能。

通过BackendConfig启用Cloud Armor：

在Cloud Armor中创建安全策略（通常通过gcloud或Terraform完成）。
在GKE的
```
BackendConfig
```
中引用该策略。

示例BackendConfig：

yaml

apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: {backend_config_name}
  namespace: {namespace}
spec:
  securityPolicy:
    name: {security_policy_name}

通过注解将

BackendConfig

与你的

Service

关联：

yaml

# 在你的Kubernetes Service清单的metadata.annotations中添加：
cloud.google.com/backend-config: '{"default": "{backend_config_name}"}'
# 或者针对特定端口映射：
cloud.google.com/backend-config: '{"ports": {"80": "{backend_config_name}"}}'

4. Configure Google-Managed SSL Certificates

4. 配置谷歌托管SSL证书

Automatically provision and renew SSL certificates.

Example ManagedCertificate (Legacy Ingress):

yaml

apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: {certificate_name}
spec:
  domains:
    - {domain_name}

Reference it in Ingress annotations:

networking.gke.io/managed-certificates: {certificate_name}

Gateway API Approach: For standard Certificate Manager integration, create a

CertificateMap

and reference it directly in the Gateway metadata annotations using

networking.gke.io/cert-map: {certificate_map_name}

, or reference a Kubernetes Secret in the HTTPS listener:

yaml

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: {gateway_name}
  namespace: {namespace}
  annotations:
    networking.gke.io/cert-map: {certificate_map_name} # For Certificate Manager maps
spec:
  gatewayClassName: gke-l7-global-external-managed
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: {secret_name} # Or directly reference a Kubernetes Secret

自动配置并续订SSL证书。

示例ManagedCertificate（遗留Ingress）：

yaml

apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: {certificate_name}
spec:
  domains:
    - {domain_name}

在Ingress注解中引用它：

networking.gke.io/managed-certificates: {certificate_name}

。

Gateway API方式： 如需与标准Certificate Manager集成，创建一个

CertificateMap

，并在Gateway元数据注解中使用

networking.gke.io/cert-map: {certificate_map_name}

直接引用它，或者在HTTPS监听器中引用Kubernetes Secret：

yaml

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: {gateway_name}
  namespace: {namespace}
  annotations:
    networking.gke.io/cert-map: {certificate_map_name} # 用于Certificate Manager映射
spec:
  gatewayClassName: gke-l7-global-external-managed
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: {secret_name} # 或直接引用Kubernetes Secret

5. Enable Container-Native Load Balancing (Recommended)

5. 启用容器原生负载均衡（推荐）

Container-native load balancing allows load balancers to target Kubernetes Pods directly, rather than targeting nodes. This improves latency and distribution.

Prerequisites: Cluster must be VPC-native.

How it works:

For GKE Ingress and Gateway API, container-native load balancing is enabled by default via Network Endpoint Groups (NEGs).
To verify or explicitly enable it for a Service, use the
```
cloud.google.com/neg
```
annotation.

Example Service Manifest:

yaml

apiVersion: v1
kind: Service
metadata:
  name: {service_name}
  annotations:
    cloud.google.com/neg: '{"ingress": true}' # Enabled for Ingress
spec:
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080
  selector:
    app: {app_name}
  type: ClusterIP

容器原生负载均衡允许负载均衡器直接指向Kubernetes Pod，而非节点。这可降低延迟并优化流量分布。

前提条件：集群必须是VPC原生集群。

工作原理：

对于GKE Ingress和Gateway API，容器原生负载均衡默认通过网络端点组（NEGs）启用。
如需验证或为Service显式启用该功能，使用
```
cloud.google.com/neg
```
注解。

示例Service清单：

yaml

apiVersion: v1
kind: Service
metadata:
  name: {service_name}
  annotations:
    cloud.google.com/neg: '{"ingress": true}' # 为Ingress启用
spec:
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080
  selector:
    app: {app_name}
  type: ClusterIP

6. Configure Private Service Connect (PSC)

6. 配置私有服务连接（PSC）

Private Service Connect allows you to expose services in one VPC to consumers in another VPC securely, without VPC peering.

Steps:

Create an internal load balancer for your service.
Create a
```
ServiceAttachment
```
referencing the load balancer.

Example ServiceAttachment Manifest:

yaml

apiVersion: networking.gke.io/v1
kind: ServiceAttachment
metadata:
  name: {attachment_name}
  namespace: {namespace}
spec:
  connectionPreference: ACCEPT_AUTOMATIC
  natSubnets:
    - {nat_subnet_name} # Subnet dedicated for PSC NAT
  resourceRef:
    kind: Service
    name: {service_name}

Share the

ServiceAttachment

URI with consumers to create a PSC endpoint in their VPC.

私有服务连接（PSC）允许你将一个VPC中的服务安全暴露给另一个VPC中的消费者，无需VPC对等连接。

步骤：

为你的服务创建内部负载均衡器。
创建引用该负载均衡器的
```
ServiceAttachment
```
。

示例ServiceAttachment清单：

yaml

apiVersion: networking.gke.io/v1
kind: ServiceAttachment
metadata:
  name: {attachment_name}
  namespace: {namespace}
spec:
  connectionPreference: ACCEPT_AUTOMATIC
  natSubnets:
    - {nat_subnet_name} # 专用于PSC NAT的子网
  resourceRef:
    kind: Service
    name: {service_name}

将

ServiceAttachment

URI分享给消费者，以便在其VPC中创建PSC端点。

Best Practices

最佳实践

Prefer Gateway API: It offers more flexibility and role separation than Ingress.
Enable Cloud Armor: Always protect public-facing endpoints with Cloud Armor.
Use Managed Certificates: Avoid managing certificate renewals manually.
Use Container-Native Load Balancing: Always use NEGs for HTTP(S) load balancing to reduce latency and improve traffic distribution.

优先使用Gateway API：相比Ingress，它提供了更高的灵活性和角色分离能力。
启用Cloud Armor：始终使用Cloud Armor保护面向公网的端点。
使用托管证书：避免手动管理证书续订。
使用容器原生负载均衡：HTTP(S)负载均衡始终使用NEGs，以降低延迟并优化流量分布。