Private Service Connect (PSC)：您可以在虛擬私有雲網路中建立私人端點，存取特定 Google API。
在 Google Cloud 控制台中，依序前往「Private Service Connect」>「Endpoints」(端點)。連線端點，或確認端點已連線至所有必要 API，例如 storage.googleapis.com 和 dataproc.googleapis.com，並連線至批次工作負載或工作階段虛擬私有雲網路。
如適用，輸出規則必須允許流量傳輸至外部服務，例如 Google Cloud以外的公開 API 和資料庫。如果批次工作負載或工作階段需要存取網際網路，您可以使用 Cloud NAT 提供子網路輸出。
雖然過於嚴格的連入規則並非連線問題的常見原因，但可能會無意間封鎖必要的傳回流量或內部通訊。
DNS 解析：
您必須在虛擬私有雲網路中設定 DNS 解析。工作負載和工作階段必須能夠解析 Google API 的主機名稱，例如 storage.googleapis.com 或bigquery.googleapis.com，以及外部服務。
自訂 DNS 伺服器和 Cloud DNS 私人區域必須轉送或解析 Google 網域的查詢。
如果您使用 Private Service Connect 私下存取 Google API，Google 服務的 DNS 記錄必須使用 PSC 端點，解析為 VPC 網路內的私人 IP 位址。
疑難排解提示：
找出網路和子網路設定：
從 Serverless for Apache Spark 批次或工作階段詳細資料中，查看 networkUri 和 subnetUri。
在 Google Cloud 控制台中，檢查 VPC 網路和子網路的設定。
從 Proxy VM 測試連線能力：
使用批次或工作階段服務帳戶，在批次或工作階段子網路中啟動測試 Compute Engine VM。
從測試 VM 執行下列連線測試：
nslookup storage.googleapis.com，驗證 DNS 解析。
查詢其他 Google API 網域，例如 bigquery.googleapis.com 和 dataproc.googleapis.com。使用私人 Google 存取權 (在 Serverless for Apache Spark 子網路上會自動啟用) 或 Private Service Connect 時，網域必須解析為私人 IP 位址。
curl -v https://storage.googleapis.com，確認與 Google API 的 HTTPS 連線。你也可以嘗試連線至其他 Google 服務。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Troubleshoot batch and session connectivity\n\nThis page provides guidance on diagnosing and resolving common network\nconnectivity issues for Serverless for Apache Spark batch workloads and interactive sessions.\nThese issues can prevent your workloads from accessing required data sources,\nexternal services, or Google Cloud APIs.\n\nCommon symptoms and error messages\n----------------------------------\n\nWhen Serverless for Apache Spark encounters connectivity problems, you might\nencounter errors such as:\n\n- `Unable to connect to service_name.googleapis.com`\n- `Could not reach required Google APIs`\n- `Connection refused`\n- `Host unreachable`\n- `Operation timed out`\n- `Permission denied` (often network-related if blocking API calls)\n\nYou might also encounter errors related to accessing data in Cloud Storage,\nBigQuery, or other databases.\n\nCommon causes and troubleshooting tips\n--------------------------------------\n\nThis section lists common causes of Serverless for Apache Spark\nconnectivity issues, and provides troubleshooting tips to help you resolve them.\n\n### Network configuration\n\nNetwork misconfigurations are a frequent cause of connectivity failures.\nServerless for Apache Spark workloads and sessions run on VMs with internal\nIP addresses, with [Private Google Access (PGA)](/vpc/docs/configure-private-google-access)\nautomatically enabled on the workload or session subnet to access\nto Google APIs and services. For more information, see\n[Serverless for Apache Spark network configuration](/dataproc-serverless/docs/concepts/network).\n\n- Access options:\n\n - Private Service Connect (PSC): You can\n [create private endpoints](/vpc/docs/about-accessing-google-apis-endpoints)\n within your VPC network to access specific Google APIs.\n\n - In the Google Cloud console, go to [**Private Service Connect \\\u003e Endpoints**](https://console.cloud.google.com/net-services/psc/list/consumers). Connect endpoints or confirm that endpoints are connected for all required APIs, such as `storage.googleapis.com` and `dataproc.googleapis.com` and that they connect to the batch workload or session Virtual Private Cloud network.\n - Cloud NAT: If your workload needs to access the public\n internet, you can configure Cloud NAT for\n your batch workload or session subnet:\n\n - In the Google Cloud console, go to the [**Cloud NAT**](https://console.cloud.google.com/net-services/nat/list) page. [Configure a gateway](/nat/docs/gce-example) or confirm that a gateway is configured for the batch workload or session VPC network, region, and subnet. Also make sure firewall rules allow egress to `0.0.0.0/0`. For more information, see [Set up Cloud NAT](/nat/docs/gce-example).\n- Firewall rules:\n\n - Egress firewall rules in your VPC network (or shared VPC network host project, if applicable) must not block outbound traffic to required destinations.\n - If applicable, egress rules must allow traffic to external services, such as public APIs and databases outside of Google Cloud. If your batch workload or session needs internet access, you can use a [Cloud NAT](/nat/docs/overview) to provide subnet egress.\n - Although not a common cause of connectivity issues, overly restrictive ingress rules might inadvertently block necessary return traffic or internal communications.\n- DNS resolution:\n\n - DNS resolution must be configured within the VPC network. Workloads and sessions must be able to resolve hostnames for Google APIs, such as `storage.googleapis.com` or`bigquery.googleapis.com` and external services.\n - Custom DNS servers and Cloud DNS private zones must forward or resolve queries for Google domains.\n - If you are using Private Service Connect for private access to Google APIs, DNS records for Google services must resolve to private IP addresses within your VPC network using the PSC endpoint.\n\nTroubleshooting tips:\n\n- Identify network and subnet configuration:\n\n - From Serverless for Apache Spark batch or session details, review the `networkUri` and `subnetUri`.\n - In the Google Cloud console, review the settings for the VPC network and subnet.\n- Test connectivity from a Proxy VM:\n\n - Launch a test Compute Engine VM in the batch or session subnet using the batch or session service account.\n - From the test VM, perform the following connectivity tests:\n - `nslookup storage.googleapis.com` to verify DNS resolution. Lookup other Google API domains, such as `bigquery.googleapis.com`and `dataproc.googleapis.com`. With Private Google Access, which is automatically enabled on Serverless for Apache Spark subnets, or Private Service Connect, the domains must resolve to private IP addresses.\n - `curl -v https://storage.googleapis.com` to verify HTTPS connectivity to Google APIs. Also try connecting to other Google services.\n - `ping 8.8.8.8` to test internet connectivity if required by your batch or session. Try `curl -v https://example.com` if Cloud NAT is expected.\n - Run Google Cloud [Network Intelligence Center connectivity tests](/network-intelligence-center/docs/connectivity-tests/concepts/overview) to diagnose network paths from your subnet to relevant endpoints, such as Google APIs and external IP addresses.\n- Review Cloud Logging for network errors:\n\n - Review Logging for your Serverless for Apache Spark workload or session. Look for `ERROR` or `WARNING` messages related to network timeouts, connection refusals, or API call failures. Filter by `jsonPayload.component=\"driver\"` or `jsonPayload.component=\"executor\"` for Spark-specific network issues.\n\n### IAM permissions\n\nInsufficient IAM permissions can prevent workloads or sessions from\naccessing resources, resulting in network failures if API calls are denied.\n\nThe service account used by your batch workload or session must have required\nroles:\n\n- **Dataproc Worker role** (`roles/dataproc.worker`).\n- Data access roles, such as `roles/storage.objectViewer` or `roles/bigquery.dataViewer`).\n- Logging: (`roles/logging.logWriter`).\n\nTroubleshooting tips:\n\n- Identify the batch workload or session [service account](/dataproc-serverless/docs/concepts/service-account). If not specified, it defaults to the [Compute Engine default service account](/compute/docs/access/service-accounts#default_service_account).\n- Go to the [**IAM \\& Admin \\\u003e IAM**](https://console.cloud.google.com/iam-admin/iam) page in the Google Cloud console, find the batch workload or session service account, and then verify that it has the necessary roles needed for workload operations. Grant any missing roles.\n\n### External service configuration\n\nIf your workload connects to databases or services outside of Google Cloud,\nverify their configuration:\n\n- Verify the external service firewall or security group allows inbound connections from your VPC network IP ranges: if applicable, check internal IP addresses using VPC Peering, Cloud VPN, or Cloud Interconnect, or Cloud NAT IP addresses.\n- Review database credentials or connectivity strings. Check connection details, usernames, and passwords.\n\nWhat's next\n-----------\n\n- Learn about [Serverless for Apache Spark networking](/dataproc-serverless/docs/concepts/network).\n- Review [Serverless for Apache Spark service accounts](/dataproc-serverless/docs/concepts/service-account).\n- Refer to general network troubleshooting guides:\n - [Troubleshoot Dataproc cluster creation issues](/dataproc/docs/support/troubleshoot-cluster-creation)\n - [Troubleshoot Dataproc Metastore connectivity](/dataproc-metastore/docs/troubleshooting-connectivity)"]]
