如要測試設定，請執行 kubectl get event。如果您看到「no BackendConfig for service port exists」訊息，表示您已成功將服務通訊埠與 BackendConfig 建立關聯，但找不到 BackendConfig 資源。如果您尚未建立 BackendConfig 資源、在錯誤的命名空間中建立 BackendConfig 資源，或是在服務註解中拼錯參照名稱，都可能發生這種錯誤。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[],[],null,["# Securing GKE apps and resources with IAP\n\nThis page explains how to secure a Google Kubernetes Engine (GKE)\ninstance with [Identity-Aware Proxy (IAP)](/iap/docs/concepts-overview).\n\nTo secure resources not on Google Cloud, see\n[Securing on-premises apps and resources](/chrome-enterprise-premium/docs/securing-on-premises).\n\nOverview\n--------\n\nIAP is integrated through [Ingress](/kubernetes-engine/docs/concepts/ingress) for\nGKE. This integration enables you to control resource-level\naccess for employees instead of using a VPN.\n\nIn a GKE cluster, incoming traffic is handled by\n[HTTP(S) Load Balancing](/load-balancing/docs/https), a component of\n[Cloud Load Balancing](/load-balancing/docs/load-balancing-overview).\nThe HTTP(S) load balancer is typically configured by the [Kubernetes Ingress\ncontroller](https://github.com/kubernetes/ingress-gce). The Ingress controller gets configuration information\nfrom a Kubernetes [Ingress](/kubernetes-engine/docs/concepts/ingress) object that is associated with one or more [Service](/kubernetes-engine/docs/concepts/service)\nobjects. Each Service object holds routing information that is used to direct an\nincoming request to a particular Pod and port.\n\nBeginning with Kubernetes version 1.10.5-gke.3, you can add configuration for\nthe load balancer by associating a Service with a [BackendConfig](/kubernetes-engine/docs/concepts/backendconfig) object.\nBackendConfig is a [custom resource definition](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) (CRD) that is\ndefined in the [kubernetes/ingress-gce](https://github.com/kubernetes/ingress-gce/tree/master/pkg/apis/backendconfig) repository.\n\nThe Kubernetes Ingress controller reads configuration information from the\nBackendConfig and sets up the load balancer accordingly. A BackendConfig holds\nconfiguration information that is specific to Cloud Load Balancing, and enables\nyou to define a separate configuration for each HTTP(S) Load Balancing backend\nservice.\n\nBefore you begin\n----------------\n\nTo enable IAP for GKE, you need the\nfollowing:\n\n- A Google Cloud console project with billing enabled.\n- A group of one or more GKE instances, served by an HTTPS load balancer. The load balancer should be created automatically when you create an Ingress object in a GKE cluster.\n - Learn about [creating an Ingress for HTTPS](/kubernetes-engine/docs/tutorials/http-balancer).\n- A domain name registered to the address of your load balancer.\n- App code to verify that all requests have an identity.\n - Learn about [getting the user's identity](/iap/docs/identity-howto).\n\nIAP uses a Google-managed OAuth client to authenticate users.\nOnly users within the organization can access the IAP-enabled\napplication. If you want to allow access to users outside of your organization,\nsee [Enable IAP for external applications](/iap/docs/custom-oauth-configuration).\n\nEnabling IAP\n------------\n\nIf you haven't configured your project's OAuth consent screen, you'll be\nprompted to do so. To configure your OAuth consent screen, see\n[Setting up your OAuth consent screen](https://support.google.com/cloud/answer/10311615).\n\nIf you are running GKE clusters version 1.24 or later, you can configure\nIAP and GKE by using the Kubernetes Gateway API. To do so, complete\nthe following steps and then follow the instructions in\n[Configure IAP](/kubernetes-engine/docs/how-to/configure-gateway-resources#configure_iap).\nDo not configure `BackendConfig`.\n\n### Setting up IAP access\n\n1. Go to the [Identity-Aware Proxy page](https://console.cloud.google.com/security/iap). \n [Go to the Identity-Aware Proxy page](https://console.cloud.google.com/security/iap)\n2. Select the project you want to secure with IAP.\n3. Select the checkbox next to the resource you want to grant access to.\n\n If you don't see a resource, ensure that the resource is created and that\n the BackendConfig Compute Engine ingress controller is synced.\n\n To verify that the backend service is available, run the following\n gcloud command:\n `gcloud compute backend-services list`\n4. On the right side panel, click **Add principal**.\n5. In the **Add principals** dialog that appears, enter the email addresses of groups or individuals who should have the **IAP-secured Web App User** role for the project.\n\n The following kinds of principals can have this role:\n - **Google Account**: user@gmail.com\n - **Google Group**: admins@googlegroups.com\n - **Service account**: server@example.gserviceaccount.com\n - **Google Workspace domain**: example.com\n\n Make sure to add a Google Account that you have access to.\n6. Select **Cloud IAP \\\u003e IAP-secured Web App User** from the **Roles** drop-down list.\n7. Click **Save**.\n\n### Configuring BackendConfig\n\n\nYou can configure a BackendConfig for IAP by adding an `iap` block.\n\n#### Adding an `iap` block to the BackendConfig\n\n\nTo configure the BackendConfig for IAP, you need to specify the\n`enabled` value. [Ensure\nthat you have the `compute.backendServices.update` permission](/iap/docs/managing-access#turning_on_and_off) and add the\n`iap` block to BackendConfig.\n| **Note:** You can't enable both IAP and Cloud CDN (Cloud CDN) in a BackendConfig. If the BackendConfig doesn't have a IAP block then any existing IAP settings on the backend service are inherited.\n\n\nFor GKE versions 1.16.8-gke.3 and higher, use the `cloud.google.com/v1` API version.\nIf you are using an earlier GKE version, use `cloud.google.com/v1beta1`. \n\n```actionscript-3\napiVersion: cloud.google.com/v1\nkind: BackendConfig\nmetadata:\n name: CONFIG_DEFAULT\n namespace: my-namespace\nspec:\n iap:\n enabled: true\n```\n\n#### Associate a service port with a BackendConfig\n\n\nYou also need to [associate Service ports with your BackendConfig](/kubernetes-engine/docs/concepts/backendconfig#associating_a_service_port_with_a_backendconfig)\nto trigger turning on IAP. One way to make this association is to make all ports\nfor the service default to your BackendConfig, which you can do by adding the following annotation\nto your Service resource: \n\n```actionscript-3\nmetadata:\n annotations:\n beta.cloud.google.com/backend-config: '{\"default\": \"\u003cvar translate=\"no\"\u003eCONFIG_DEFAULT\u003c/var\u003e\"}'\n```\n\n#### Verify the BackendConfig\n\n\nTo test the configuration, run `kubectl get event`. If you see the message\n\"`no BackendConfig for service port exists`\", then you successfully\nassociated a service port with your BackendConfig, but the BackendConfig\nresource wasn't found. This error can occur if you haven't created the BackendConfig resource,\ncreated it in the wrong namespace, or misspelled the reference in the Service annotation.\n| **Note:** IAP adds the `gcp-iap-mode=AUTHENTICATING` query parameter to the redirected request that occurs after OAuth authentication, so be sure to check your ingress load balancer's [routing configuration](https://cloud.google.com/load-balancing/docs/url-map) to ensure that redirected requests are going to the correct backend service after a user authenticates through OAuth.\n| **Note:** You might get an \\`Add firewall rule\\` warning message on the IAP configuration page for network endpoint group (NEG) based backends even though the correct firewall rule exists. The firewall rule warning is informational and can be safely ignored.\n\nTurning IAP off\n---------------\n\n\nTo turn IAP off, you must set `enabled` to\n`false` in the BackendConfig. If you delete the IAP\nblock from BackendConfig, the settings will persist. For example, if IAP is\nenabled and you delete the block then IAP will still be turned on.\n\nNext steps\n----------\n\n- Set richer context rules by [applying access levels](/chrome-enterprise-premium/docs/access-levels).\n- See access requests by [enabling Cloud Audit Logs](/chrome-enterprise-premium/docs/audit-logs).\n- Learn more about [IAP](/iap/docs/concepts-overview).\n- [Learn how to set up Cloud CDN on GKE](/kubernetes-engine/docs/how-to/cdn-backendconfig).\n- [Learn how to configure Cloud Armor for GKE](/kubernetes-engine/docs/how-to/cloud-armor-backendconfig).\n- [Learn more about the BackendConfig resource](/kubernetes-engine/docs/concepts/backendconfig)."]]
