本页面适用于想要安装、配置和支持网络设备的网络专家。如需详细了解我们在 Google Cloud 内容中提及的常见角色和示例任务，请参阅常见的 GKE 用户角色和任务。
代管式 NSG
GKE on Azure 管理连接到每个虚拟机 (VM) 实例的虚拟网络接口卡 (NIC) 的 NSG。如需进一步控制网络流量，您可以向子网添加其他 NSG。
GKE on Azure 会自动管理所需的 NSG 规则。它会添加缺少的 NSG 规则，并移除不再需要的规则。GKE on Azure 还可以根据您的 Kubernetes Service 配置来修改规则。例如，当您添加 LoadBalancer 类型的 Kubernetes Service 时，GKE on Azure 会添加相应的 NSG 规则。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[],[],null,["# Network security groups\n=======================\n\nThis page describes and lists the\n[Azure network security groups (NSGs)](https://docs.microsoft.com/azure/virtual-network/network-security-groups-overview)\nrequired by GKE on Azure.\n\nThis page is for Networking specialists who want to install, configure, and\nsupport network equipment. To learn more about common roles and example tasks\nthat we reference in Google Cloud content, see\n[Common GKE user roles and tasks](/kubernetes-engine/enterprise/docs/concepts/roles-tasks).\n\nManaged NSGs\n------------\n\nGKE on Azure manages the NSGs attached to the virtual network\ninterface card (NIC) of each virtual machine (VM) instance. To further control\nnetwork traffic, you can add additional NSGs to your subnets.\n\nGKE on Azure manages required NSG rules automatically. It adds missing\nNSG rules and removes rules that are no longer necessary. GKE on Azure\nalso modifies rules based on your Kubernetes Service configuration. For example,\nwhen you add a Kubernetes Service of type `LoadBalancer`, GKE on Azure\nadds the corresponding NSG rules.\n\nRule priorities\n---------------\n\nAzure NSG rule priorities have a range between 100 and 4096. The lower the\npriority number, the higher the priority.\n\nBy design, GKE on Azure manages only NSG rules with a priority of 500\nor higher. Therefore, if you need to implement a specific rule or create\nadditional rules, you can use NSGs with a priority between 100 and 499.\n\nAzure processes rules in order, starting with the lowest priority number and\nproceeding upward. When you create a new rule, always choose rule priorities in\nthe 100 to 499 range to avoid conflict with existing Anthos NSG rules.\n\nApplication security groups\n---------------------------\n\nGKE on Azure creates two\n[application security groups (ASGs)](https://docs.microsoft.com/azure/virtual-network/application-security-groups)\nthat apply to the virtual NICs of control planes and worker nodes.\nGKE on Azure updates ASGs automatically---for\nexample, when you add a new node pool to a cluster. You can use these ASGs\nwhen creating NSG rules.\n\nThe Azure Resource Manager (ARM) IDs of the NSG and control plane ASG\ncan be obtained from the output of\n[`gcloud container azure clusters describe`](/sdk/gcloud/reference/container/azure/clusters/describe).\n\nFor example, to allow SSH connections to the control plane VMs, run the\n`az network nsg rule create` command to create an NSG that references\nthe control plane ASG: \n\n NSG_NAME=$(basename $(gcloud container azure clusters describe \\\n \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n --format 'value(managedResources.networkSecurityGroupId)'))\n\n ASG_CP_NAME=$(basename $(gcloud container azure clusters describe \\\n \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n --format 'value(managedResources.controlPlaneApplicationSecurityGroupId)'))\n\n az network nsg rule create \\\n --name AllowSshToControlPlane \\\n --nsg-name \"${NSG_NAME}\" \\\n --priority 100 \\\n --resource-group \"\u003cvar translate=\"no\"\u003eCLUSTER_RESOURCE_GROUP\u003c/var\u003e\" \\\n --access Allow \\\n --protocol Tcp \\\n --destination-port-ranges 22 \\\n --destination-asgs \"${ASG_CP_NAME}\"\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of your cluster\n- \u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e: the Google Cloud location that manages your cluster\n- \u003cvar translate=\"no\"\u003eCLUSTER_RESOURCE_GROUP\u003c/var\u003e: the name of the Azure resource group that holds your cluster\n\nFor more information about creating a new rule, follow the procedure described in\n[Azure NSG rule creation](https://docs.microsoft.com/cli/azure/network/nsg/rule?view=azure-cli-latest#az_network_nsg_rule_create).\n\nDefault NSG rules\n-----------------\n\nWhen you set up GKE on Azure, it creates the following NSG rules in\nyour Azure virtual network."]]
