限定公開クラスタは、内部 IP アドレスのみに依存する Virtual Private Cloud（VPC）ネイティブ クラスタです。つまり、デフォルトでノードと Pod はインターネットから隔離されています。このページでは、Cloud Code を使用して、パブリック エンドポイント アクセスの有無にかかわらず限定公開クラスタに接続し、限定公開クラスタが Google Cloudの外部からリソースにアクセスできるようにする方法について説明します。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003ePrivate clusters in Cloud Code are VPC-native and isolate nodes and pods from the public internet by default, relying on internal IP addresses.\u003c/p\u003e\n"],["\u003cp\u003eCloud Code can connect to private clusters both with and without public endpoint access, using either the external or internal IP address in the KubeConfig.\u003c/p\u003e\n"],["\u003cp\u003eTo connect to a private cluster, Cloud Code must be on a machine within the cluster's network or have access via a proxy server, Cloud Interconnect, or Cloud VPN.\u003c/p\u003e\n"],["\u003cp\u003eCloud Code can configure a proxy server for clusters without public API access to enable communication with the control plane.\u003c/p\u003e\n"],["\u003cp\u003eCloud Code can enable outbound internet connections for private clusters to access external resources through Cloud NAT.\u003c/p\u003e\n"]]],[],null,["# Configure a private cluster in Cloud Code for IntelliJ\n\nA *private cluster* is a Virtual Private Cloud (VPC)-native cluster that only\ndepends on [internal IP addresses](/kubernetes-engine/docs/concepts/alias-ips#internal_ip_addresses).\nThis means that nodes and pods are isolated from the internet by default. This\npage explains how to use Cloud Code to connect to private\nclusters with and without public endpoint access and permit private clusters to\naccess resources from outside Google Cloud.\n\nFor information about private clusters, see\n[Private clusters](/kubernetes-engine/docs/concepts/private-cluster-concept).\nFor steps to configure private clusters, see\n[Creating a private cluster](/kubernetes-engine/docs/how-to/private-clusters).\n\nAdd a private GKE cluster to your KubeConfig\n--------------------------------------------\n\nAdding a private cluster in Cloud Code has the following behavior:\n\n- For clusters that have the public endpoint enabled, adding the cluster sets\n the cluster address in the KubeConfig to the external IP.\n\n- For clusters that have the public endpoint turned off, adding the cluster sets\n the cluster address in the KubeConfig to be the internal VPC IP of the\n cluster.\n\nTo add an authorized network to an existing cluster, make sure you are connected\nto an authorized network, as this cluster has [authorized networks enabled](/kubernetes-engine/docs/how-to/authorized-networks#add).\n\nTo learn more about connecting to VMs without external IP addresses, see\n[Securely connecting to VM instances](/solutions/connecting-securely#external).\nTo manage/delete the instances that you created, see\n[VM instances](https://console.cloud.google.com/compute/instances).\n\nTo successfully connect to the private cluster, Cloud Code must be\nrunning on a machine in the cluster's network or be able to access the cluster's\nnetwork, such as by using a proxy server, Cloud Interconnect, or\nCloud VPN.\n\nFor steps to create GKE clusters in Cloud Code\nand add existing GKE clusters to Cloud Code, see\n[create and configure a GKE cluster](/code/docs/intellij/create-configure-gke-cluster).\nCloud Code opens the Google Cloud console to create your cluster.\n\nAfter you create the cluster, [configure Cloud NAT](/nat/docs/gke-example?_ga=2.200274222.-1614030937.1640827593#gcloud)\nto enable outbound internet connections from your cluster if this was not set up\nduring cluster creation. To manage/delete the networks that you created, see\n[VPC networks](https://console.cloud.google.com/networking/networks/list).\n\nTroubleshoot issues connecting to private clusters\n--------------------------------------------------\n\nIf your dev environment isn't configured correctly to access a private cluster,\nrecommendations about how to resolve the issue appear in the following contexts:\n\n- In the Kubernetes Explorer, clusters that Cloud Code can't\n connect to appear with an error icon next to the cluster name.\n\n- When you try to run operations on a cluster that's inaccessible because of\n potential issues with the private cluster's configuration, a tooltip displays\n an error message with a longer explanation of the potential issue and\n potential workarounds. To view the error message, hold the pointer over a\n cluster with an error icon.\n\n- To view private cluster docs, right-click a cluster and select **View Private\n Cluster Docs**.\n\nConfigure a proxy server for a cluster\n--------------------------------------\n\nIf the\n[control plane API](https://kubernetes.io/docs/concepts/overview/kubernetes-api/)\nisn't available publicly, such as in a GKE cluster with public\nendpoint turned off, you can configure Cloud Code to proxy\nrequests to the control plane through a proxy server on the same network or VPC\nas the cluster:\n\n1. Configure a proxy server on the same network as your cluster if you haven't already. For steps to set up a Compute Engine VM as a basic proxy server, see [Remotely access a private cluster using a bastion host](/kubernetes-engine/docs/tutorials/private-cluster-bastion). For additional details, see [Creating Google Kubernetes Engine private clusters with network proxies for controller access](/architecture/creating-kubernetes-engine-private-clusters-with-net-proxies).\n2. Right-click the name of a cluster you've [added to Cloud Code](#private) and then click **Setup Kubectl Proxying** . Follow the prompts to enter the name of your proxy server, which is stored in the cluster's `proxy-url` field. The Kubernetes Explorer reloads to display the connected cluster.\n\n### Cancel Kubernetes proxying\n\nRight-click the name of a cluster you've configured for Kubernetes proxying and\nthen click **Cancel Kubectl Proxying** . Cloud Code\nstops proxying requests for the cluster by unsetting the `proxy-url` field\nin the KubeConfig.\n\nAccess resources outside Google Cloud from clusters\n---------------------------------------------------\n\nAll configurations of GKE private clusters don't provide nodes\nwith internet access. As a result, clusters can't reach APIs on the public\ninternet. Clusters are automatically configured with\n[Private Google Access](/vpc/docs/private-google-access),\nwhich, for example, permits clusters to pull images from Artifact Registry. APIs and\nimage registries outside of Google Cloud are inaccessible without\nadditional configuration to allow outbound internet connections from the nodes.\nTo provide these connections, you can set up\n[Cloud NAT](/nat/docs/overview#NATwithGKE) on your VPC from\nCloud Code:\n\n1. In the Kubernetes Explorer, right-click a cluster and select **Grant Private\n GKE Internet**.\n2. In the terminal, edit the [`gcloud compute routers create`](/sdk/gcloud/reference/compute/routers/create) and [`gcloud beta compute routers nats create`](/sdk/gcloud/reference/beta/compute/routers/nats/create) commands to specify the values for your application. Make sure that you choose the `{REGION}` where the private cluster is located. For a list of supported regions, see [Regions and zones](/compute/docs/regions-zones).\n3. To run the commands, press `Enter`.\n4. To manage/delete the routers that you created, see [Cloud Routers](https://console.cloud.google.com/hybrid/routers/list).\n\nWhat's next\n-----------\n\n- Learn about [Shared Virtual Private Cloud networks](/vpc/docs/shared-vpc).\n\nGet support\n-----------\n\nTo submit feedback or report an issue in your IntelliJ IDE, go to **Tools** \\\u003e **Cloud Code** \\\u003e **Help / About** \\\u003e **Submit\nfeedback or report an issue** to report an issue on [GitHub](https://github.com/GoogleCloudPlatform/cloud-code-intellij/issues)."]]
