Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menunjukkan cara membuat bucket penyimpanan yang terisolasi dari jaringan Google Distributed Cloud (GDC).
Sebelum memulai
Namespace project mengelola resource bucket di server Management API. Anda
harus memiliki project untuk menggunakan bucket dan objek.
Anda juga harus memiliki izin bucket yang sesuai untuk melakukan operasi berikut. Lihat Memberikan akses bucket.
Panduan penamaan bucket penyimpanan
Nama bucket harus mematuhi konvensi penamaan berikut:
Bersifat unik dalam project. Project menambahkan awalan unik ke nama bucket, sehingga tidak ada konflik dalam organisasi. Jika terjadi konflik nama bucket dan awalan di seluruh organisasi, pembuatan bucket akan gagal dengan error "nama bucket sedang digunakan".
Jangan menyertakan informasi identitas pribadi (PII).
Sesuai dengan DNS.
Memiliki minimal 1 dan maksimal 55 karakter.
Mulai dengan huruf dan hanya gunakan huruf, angka, dan tanda hubung.
Membuat bucket
Konsol
Di menu navigasi, klik Object Storage.
Klik Create Bucket.
Dalam alur pembuatan bucket, tetapkan nama yang unik di semua bucket dalam project.
Masukkan deskripsi.
Opsional: Klik tombol toggle_off untuk menetapkan kebijakan retensi dan masukkan jumlah hari yang Anda inginkan. Hubungi IO Anda jika Anda perlu melampaui batas kebijakan retensi.
Klik Buat. Pesan sukses akan muncul dan Anda akan diarahkan kembali ke halaman Bucket.
Untuk memverifikasi bahwa Anda telah berhasil membuat bucket baru, muat ulang halaman Bucket setelah beberapa menit dan periksa apakah status bucket berubah dari Not ready menjadi Ready.
CLI
Untuk membuat bucket, terapkan spesifikasi bucket ke namespace project Anda:
Perhatikan bahwa hanya enkripsi V2 yang didukung untuk bucket zona ganda dan semua operasi untuk membuat, memperbarui, atau menghapus resource bucket zona ganda harus dilakukan terhadap server API global.
Memverifikasi pembuatan bucket dan resource terkait
Setelah bucket dibuat, Anda dapat menjalankan perintah berikut untuk mengonfirmasi dan memeriksa detail bucket:
kubectldescribebucketsBUCKET_NAME-nNAMESPACE_NAME
Bagian Status memiliki dua kolom penting: Enkripsi (untuk detail enkripsi) dan Nama yang Sepenuhnya Memenuhi Syarat (yang berisi FULLY_QUALIFIED_BUCKET_NAME).
Enkripsi v1
Informasi ini adalah tentang AEADKey yang diberi nama obj-FULLY_QUALIFIED_BUCKET_NAME, yang berfungsi sebagai referensi ke kunci enkripsi yang digunakan untuk mengenkripsi objek yang disimpan dalam bucket. Berikut ini contohnya:
Informasi ini berkaitan dengan Secret yang diberi nama kek-ref-FULLY_QUALIFIED_BUCKET_NAME, yang berfungsi sebagai referensi untuk AEADKey default aktif. AEADKey default yang aktif dipilih secara acak untuk mengenkripsi objek yang diupload ke bucket saat AEADKey tertentu tidak ditentukan.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis guide outlines the process for creating air-gapped storage buckets within Google Distributed Cloud (GDC), which requires a project namespace for resource management and appropriate bucket permissions.\u003c/p\u003e\n"],["\u003cp\u003eBucket names must be unique within a project, DNS-compliant, between 1 and 55 characters, start with a letter, and use only letters, numbers, and hyphens, while refraining from containing personally identifiable information (PII).\u003c/p\u003e\n"],["\u003cp\u003eBuckets can be created through the console by navigating to Object Storage and filling out the creation flow or via the command line using a bucket specification in a YAML file.\u003c/p\u003e\n"],["\u003cp\u003eNewly created buckets are automatically encrypted, with \u003ccode\u003ev2\u003c/code\u003e being the default and strongly recommended for better encryption and security, unless \u003ccode\u003ev1\u003c/code\u003e is specifically designated for higher performance with many small objects.\u003c/p\u003e\n"],["\u003cp\u003eVerification of bucket creation and details, including encryption information and the fully qualified name, can be performed by using \u003ccode\u003ekubectl describe buckets\u003c/code\u003e and \u003ccode\u003ekubectl get aeadkeys\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Create storage buckets for projects\n\nThis page shows you how to create Google Distributed Cloud (GDC) air-gapped storage buckets.\n\nBefore you begin\n----------------\n\nA project namespace manages bucket resources in the Management API server. You\nmust have a [project](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/project-management) to work with buckets and objects.\n\nYou must also have the appropriate bucket permissions to perform the following\noperation. See [Grant bucket access](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/grant-obtain-storage-access#grant_bucket_access).\n\nStorage bucket naming guidelines\n--------------------------------\n\nBucket names must adhere to the following naming conventions:\n\n- Be unique within the project. A project appends a unique prefix to the bucket name, ensuring there aren't clashes within the organization. In the unlikely event of a prefix and bucket name clash across organizations, the bucket creation fails with a \"bucket name in use\" error.\n- Refrain from including any personally identifiable information (PII).\n- Be DNS-compliant.\n- Have at least 1 and no more than 55 characters.\n- Start with a letter and use only letters, numbers, and hyphens.\n\nCreate a bucket\n---------------\n\n**Note:** The bucket that is created will be automatically encrypted with either version `v1` or `v2`. `v2` will be the default if the `encryption-version` label is not specified since `v2` bucket is strongly recommended as it has better encryption and security. `v1` is only recommended if you need higher performance for many small objects. \n\n### Console\n\n1. In the navigation menu, click **Object Storage**.\n2. Click **Create Bucket**.\n3. In the bucket creation flow, assign a name unique across all buckets within the project.\n4. Enter a description.\n5. Optional: Click the toggle_off toggle to set a retention policy and enter your preferred number of days. Contact your IO if you need to exceed retention policy limits.\n6. Click **Create** . A success message appears and you are directed back to the **Buckets** page.\n\nTo verify that you have successfully created a new bucket, refresh the **Buckets** page after a few minutes and check that the bucket state updates from `Not ready` to `Ready`.\n\n### CLI\n\nTo create a bucket, apply a bucket specification to your project namespace: \n\n kubectl apply -f bucket.yaml\n\nThe following is an example of a bucket specification: \n\n apiVersion: object.gdc.goog/v1\n kind: Bucket\n metadata:\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eBUCKET_NAME\u003c/span\u003e\u003c/var\u003e\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n spec:\n description: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eDESCRIPTION\u003c/span\u003e\u003c/var\u003e\n storageClass: Standard\n bucketPolicy:\n lockingPolicy:\n defaultObjectRetentionDays: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eRETENTION_DAY_COUNT\u003c/span\u003e\u003c/var\u003e\n\nThe following is an example of a bucket specification with encryption version as `v1`: \n\n apiVersion: object.gdc.goog/v1\n kind: Bucket\n metadata:\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eBUCKET_NAME\u003c/span\u003e\u003c/var\u003e\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n labels:\n object.gdc.goog/encryption-version: v1\n spec:\n description: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eDESCRIPTION\u003c/span\u003e\u003c/var\u003e\n storageClass: Standard\n bucketPolicy:\n lockingPolicy:\n defaultObjectRetentionDays: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eRETENTION_DAY_COUNT\u003c/span\u003e\u003c/var\u003e\n\nFor more details, see the [Bucket API reference](../../apis/storage-krm-api.md).\n\nThe following is an example of a dual-zone bucket in org-admin global API: \n\n apiVersion: object.global.gdc.goog/v1\n kind: Bucket\n metadata:\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eBUCKET_NAME\u003c/span\u003e\u003c/var\u003e\n namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003ePROJECT_NAME\u003c/span\u003e\u003c/var\u003e\n spec:\n location: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eLOCATION_NAME\u003c/span\u003e\u003c/var\u003e\n description: Sample DZ Bucket\n storageClass: Standard\n\nNote that only V2 encryption is supported for dual-zone buckets and all operations for creating, updating, or deleting a dual-zone bucket resource must be performed against the global API server.\n\n### gdcloud\n\nTo create a bucket with gdcloud, follow [gdcloud storage buckets create](/distributed-cloud/hosted/docs/latest/gdch/resources/gdcloud-reference/gdcloud-storage-buckets-create).\n\nVerify bucket and related resource creation\n-------------------------------------------\n\nOnce the bucket is created, you can run the following command to confirm and check the details of the bucket: \n\n kubectl describe buckets \u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e -n \u003cvar translate=\"no\"\u003eNAMESPACE_NAME\u003c/var\u003e\n\nThe **Status** section has two important fields: **Encryption** (for encryption details) and **Fully Qualified Name** (which contains the \u003cvar translate=\"no\"\u003eFULLY_QUALIFIED_BUCKET_NAME\u003c/var\u003e). \n\n### Encryption v1\n\nThe information is about the AEADKey named as `obj-`\u003cvar translate=\"no\"\u003eFULLY_QUALIFIED_BUCKET_NAME\u003c/var\u003e, which serves as a reference to the encryption key employed for encrypting objects stored within the bucket. Here is an example: \n\n Status:\n Encryption:\n Key Ref:\n Kind: AEADKey\n Name: obj-\u003cvar translate=\"no\"\u003eFULLY_QUALIFIED_BUCKET_NAME\u003c/var\u003e\n Namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n Type: CMEK\n\n### Encryption v2\n\nThe information pertains to the Secret named as `kek-ref-`\u003cvar translate=\"no\"\u003eFULLY_QUALIFIED_BUCKET_NAME\u003c/var\u003e, which acts as a reference for active default AEADKeys. Active default AEADKeys are randomly selected from to encrypt objects uploaded to the bucket when specific AEADKey is not specified.\n| **Note:** Inactive default AEADKeys are those that are no longer referenced in the Secret. See the Manage Encryption Resources section for more info.\n\nHere is an example: \n\n Status:\n Encryption:\n Key Ref:\n Kind: Secret\n Name: kek-ref-\u003cvar translate=\"no\"\u003eFULLY_QUALIFIED_BUCKET_NAME\u003c/var\u003e\n Namespace: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eNAMESPACE_NAME\u003c/span\u003e\u003c/var\u003e\n Type: CMEK\n\nYou can also run the following command to verify needed AEADKeys are created: \n\n kubectl get aeadkeys -n \u003cvar translate=\"no\"\u003eNAMESPACE_NAME\u003c/var\u003e -l cmek.security.gdc.goog/resource-name=\u003cvar translate=\"no\"\u003eFULLY_QUALIFIED_BUCKET_NAME\u003c/var\u003e"]]
