如需测试配置，请运行 kubectl get event。如果看到消息“no BackendConfig for service port exists”，则说明您已成功将服务端口与 BackendConfig 关联，但是未找到 BackendConfig 资源。如果您没有创建 BackendConfig 资源，或在错误的命名空间中创建了该资源，或在 Service 注释中拼错了引用，则会出现此错误。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[],[],null,["# Securing GKE apps and resources with IAP\n\nThis page explains how to secure a Google Kubernetes Engine (GKE)\ninstance with [Identity-Aware Proxy (IAP)](/iap/docs/concepts-overview).\n\nTo secure resources not on Google Cloud, see\n[Securing on-premises apps and resources](/chrome-enterprise-premium/docs/securing-on-premises).\n\nOverview\n--------\n\nIAP is integrated through [Ingress](/kubernetes-engine/docs/concepts/ingress) for\nGKE. This integration enables you to control resource-level\naccess for employees instead of using a VPN.\n\nIn a GKE cluster, incoming traffic is handled by\n[HTTP(S) Load Balancing](/load-balancing/docs/https), a component of\n[Cloud Load Balancing](/load-balancing/docs/load-balancing-overview).\nThe HTTP(S) load balancer is typically configured by the [Kubernetes Ingress\ncontroller](https://github.com/kubernetes/ingress-gce). The Ingress controller gets configuration information\nfrom a Kubernetes [Ingress](/kubernetes-engine/docs/concepts/ingress) object that is associated with one or more [Service](/kubernetes-engine/docs/concepts/service)\nobjects. Each Service object holds routing information that is used to direct an\nincoming request to a particular Pod and port.\n\nBeginning with Kubernetes version 1.10.5-gke.3, you can add configuration for\nthe load balancer by associating a Service with a [BackendConfig](/kubernetes-engine/docs/concepts/backendconfig) object.\nBackendConfig is a [custom resource definition](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) (CRD) that is\ndefined in the [kubernetes/ingress-gce](https://github.com/kubernetes/ingress-gce/tree/master/pkg/apis/backendconfig) repository.\n\nThe Kubernetes Ingress controller reads configuration information from the\nBackendConfig and sets up the load balancer accordingly. A BackendConfig holds\nconfiguration information that is specific to Cloud Load Balancing, and enables\nyou to define a separate configuration for each HTTP(S) Load Balancing backend\nservice.\n\nBefore you begin\n----------------\n\nTo enable IAP for GKE, you need the\nfollowing:\n\n- A Google Cloud console project with billing enabled.\n- A group of one or more GKE instances, served by an HTTPS load balancer. The load balancer should be created automatically when you create an Ingress object in a GKE cluster.\n - Learn about [creating an Ingress for HTTPS](/kubernetes-engine/docs/tutorials/http-balancer).\n- A domain name registered to the address of your load balancer.\n- App code to verify that all requests have an identity.\n - Learn about [getting the user's identity](/iap/docs/identity-howto).\n\nIAP uses a Google-managed OAuth client to authenticate users.\nOnly users within the organization can access the IAP-enabled\napplication. If you want to allow access to users outside of your organization,\nsee [Enable IAP for external applications](/iap/docs/custom-oauth-configuration).\n\nEnabling IAP\n------------\n\nIf you haven't configured your project's OAuth consent screen, you'll be\nprompted to do so. To configure your OAuth consent screen, see\n[Setting up your OAuth consent screen](https://support.google.com/cloud/answer/10311615).\n\nIf you are running GKE clusters version 1.24 or later, you can configure\nIAP and GKE by using the Kubernetes Gateway API. To do so, complete\nthe following steps and then follow the instructions in\n[Configure IAP](/kubernetes-engine/docs/how-to/configure-gateway-resources#configure_iap).\nDo not configure `BackendConfig`.\n\n### Setting up IAP access\n\n1. Go to the [Identity-Aware Proxy page](https://console.cloud.google.com/security/iap). \n [Go to the Identity-Aware Proxy page](https://console.cloud.google.com/security/iap)\n2. Select the project you want to secure with IAP.\n3. Select the checkbox next to the resource you want to grant access to.\n\n If you don't see a resource, ensure that the resource is created and that\n the BackendConfig Compute Engine ingress controller is synced.\n\n To verify that the backend service is available, run the following\n gcloud command:\n `gcloud compute backend-services list`\n4. On the right side panel, click **Add principal**.\n5. In the **Add principals** dialog that appears, enter the email addresses of groups or individuals who should have the **IAP-secured Web App User** role for the project.\n\n The following kinds of principals can have this role:\n - **Google Account**: user@gmail.com\n - **Google Group**: admins@googlegroups.com\n - **Service account**: server@example.gserviceaccount.com\n - **Google Workspace domain**: example.com\n\n Make sure to add a Google Account that you have access to.\n6. Select **Cloud IAP \\\u003e IAP-secured Web App User** from the **Roles** drop-down list.\n7. Click **Save**.\n\n### Configuring BackendConfig\n\n\nYou can configure a BackendConfig for IAP by adding an `iap` block.\n\n#### Adding an `iap` block to the BackendConfig\n\n\nTo configure the BackendConfig for IAP, you need to specify the\n`enabled` value. [Ensure\nthat you have the `compute.backendServices.update` permission](/iap/docs/managing-access#turning_on_and_off) and add the\n`iap` block to BackendConfig.\n| **Note:** You can't enable both IAP and Cloud CDN (Cloud CDN) in a BackendConfig. If the BackendConfig doesn't have a IAP block then any existing IAP settings on the backend service are inherited.\n\n\nFor GKE versions 1.16.8-gke.3 and higher, use the `cloud.google.com/v1` API version.\nIf you are using an earlier GKE version, use `cloud.google.com/v1beta1`. \n\n```actionscript-3\napiVersion: cloud.google.com/v1\nkind: BackendConfig\nmetadata:\n name: CONFIG_DEFAULT\n namespace: my-namespace\nspec:\n iap:\n enabled: true\n```\n\n#### Associate a service port with a BackendConfig\n\n\nYou also need to [associate Service ports with your BackendConfig](/kubernetes-engine/docs/concepts/backendconfig#associating_a_service_port_with_a_backendconfig)\nto trigger turning on IAP. One way to make this association is to make all ports\nfor the service default to your BackendConfig, which you can do by adding the following annotation\nto your Service resource: \n\n```actionscript-3\nmetadata:\n annotations:\n beta.cloud.google.com/backend-config: '{\"default\": \"\u003cvar translate=\"no\"\u003eCONFIG_DEFAULT\u003c/var\u003e\"}'\n```\n\n#### Verify the BackendConfig\n\n\nTo test the configuration, run `kubectl get event`. If you see the message\n\"`no BackendConfig for service port exists`\", then you successfully\nassociated a service port with your BackendConfig, but the BackendConfig\nresource wasn't found. This error can occur if you haven't created the BackendConfig resource,\ncreated it in the wrong namespace, or misspelled the reference in the Service annotation.\n| **Note:** IAP adds the `gcp-iap-mode=AUTHENTICATING` query parameter to the redirected request that occurs after OAuth authentication, so be sure to check your ingress load balancer's [routing configuration](https://cloud.google.com/load-balancing/docs/url-map) to ensure that redirected requests are going to the correct backend service after a user authenticates through OAuth.\n| **Note:** You might get an \\`Add firewall rule\\` warning message on the IAP configuration page for network endpoint group (NEG) based backends even though the correct firewall rule exists. The firewall rule warning is informational and can be safely ignored.\n\nTurning IAP off\n---------------\n\n\nTo turn IAP off, you must set `enabled` to\n`false` in the BackendConfig. If you delete the IAP\nblock from BackendConfig, the settings will persist. For example, if IAP is\nenabled and you delete the block then IAP will still be turned on.\n\nNext steps\n----------\n\n- Set richer context rules by [applying access levels](/chrome-enterprise-premium/docs/access-levels).\n- See access requests by [enabling Cloud Audit Logs](/chrome-enterprise-premium/docs/audit-logs).\n- Learn more about [IAP](/iap/docs/concepts-overview).\n- [Learn how to set up Cloud CDN on GKE](/kubernetes-engine/docs/how-to/cdn-backendconfig).\n- [Learn how to configure Cloud Armor for GKE](/kubernetes-engine/docs/how-to/cloud-armor-backendconfig).\n- [Learn more about the BackendConfig resource](/kubernetes-engine/docs/concepts/backendconfig)."]]
