조직 네트워크 정책은 Google Distributed Cloud (GDC) 에어갭을 통해 노출되는 조직 수준 관리 서비스의 네트워크 액세스 제어를 정의합니다. 네트워킹 API의 OrganizationNetworkPolicy 리소스를 사용하여 이러한 액세스 제어를 정의할 수 있습니다.
조직 네트워크 정책을 구성하는 데 필요한 권한을 얻으려면 조직 ID 및 액세스 관리 (IAM) 관리자에게 조직 네트워크 정책 관리자 (org-network-policy-admin) 역할을 부여해 달라고 요청하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eAn Organization Network Policy in Google Distributed Cloud (GDC) air-gapped defines network access controls for organization-level managed services, managed via the \u003ccode\u003eOrganizationNetworkPolicy\u003c/code\u003e resource in the Networking API.\u003c/p\u003e\n"],["\u003cp\u003eThe Org Network Policy Admin (\u003ccode\u003eorg-network-policy-admin\u003c/code\u003e) role is required to configure the organization network policy.\u003c/p\u003e\n"],["\u003cp\u003eGDC managed services such as the GDC console, Distributed Cloud CLI, Global API server, KMS, Object storage, and Vertex AI can have organization network policies defined for them.\u003c/p\u003e\n"],["\u003cp\u003eBy default, the Global API server, KMS, Object storage, and Vertex AI services have a \u003ccode\u003edeny-by-default\u003c/code\u003e principle, while other services like GDC console and the Distributed Cloud CLI are \u003ccode\u003eallow-all\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eAn \u003ccode\u003eOrganizationNetworkPolicy\u003c/code\u003e resource example is provided that demonstrates how to allow traffic from specified IP addresses to access a designated GDC managed service, using variables like \u003ccode\u003eMANAGEMENT_API_SERVER\u003c/code\u003e, \u003ccode\u003ePOLICY_NAME\u003c/code\u003e, \u003ccode\u003eSERVICE_NAME\u003c/code\u003e, and \u003ccode\u003eIP_ADDRESS\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Create organization network policies\n\nAn organization network policy defines the network access control for\norganization-level managed services exposed through Google Distributed Cloud (GDC) air-gapped. You can define these access controls using the\n[`OrganizationNetworkPolicy`](/distributed-cloud/hosted/docs/latest/gdch/apis/service/networking/v1/networking-v1#organizationnetworkpolicy)\nresource from the\n[Networking API](/distributed-cloud/hosted/docs/latest/gdch/apis/service/networking/networking-api-overview).\n\nTo get the permissions you need to configure the organization network policy,\nask your Organization Identity and Access Management (IAM) Admin to grant you the Org\nNetwork Policy Admin (`org-network-policy-admin`) role.\n\nYou can define an organization network policy for access controls for the\nfollowing GDC managed services:\n\n- All services\n- GDC console\n- [Distributed Cloud CLI](/distributed-cloud/hosted/docs/latest/gdch/resources/gdcloud-overview)\n- [Global API server](/distributed-cloud/hosted/docs/latest/gdch/resources/multi-zone/api-servers)\n- [Key Management Systems (KMS)](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/kms/kms)\n- [Object storage](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/storage#object_storage)\n- [Vertex AI](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/vertex-pre-trained-apis)\n - Services within Vertex AI that a policy supports include the [Optical Character Recognition API](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/quickstart-ocr), [Speech-to-Text API](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/quickstart-stt), [Translation API](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/quickstart-translation), and [Workbench](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vertex-ai-workbench-intro).\n\nDefault policy\n--------------\n\nBy default, the following GDC managed services have\nthe following principles:\n\nExample organization network policy\n-----------------------------------\n\nThe following is an example of an `OrganizationNetworkPolicy` resource that\nallows traffic from an IP address to access a GDC\nmanaged service. \n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e apply -f - \u003c\u003cEOF\n apiVersion: networking.gdc.goog/v1\n kind: OrganizationNetworkPolicy\n metadata:\n name: \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e\n namespace: platform\n spec:\n subject:\n services:\n matchTypes:\n - \"\u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e\"\n ingress:\n - from:\n - ipBlock:\n cidr: \u003cvar translate=\"no\"\u003eIP_ADDRESS\u003c/var\u003e\n - ipBlock:\n cidr: \u003cvar translate=\"no\"\u003eIP_ADDRESS\u003c/var\u003e\n EOF\n\nReplace the following variables:"]]
