Crea policy di rete del progetto per i servizi gestiti
Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Questa pagina fornisce istruzioni per creare criteri di rete del progetto per i servizi gestiti in Google Distributed Cloud (GDC) air-gapped.
Un servizio gestito GDC è un servizio creato e gestito da Google. È disponibile per impostazione predefinita per tutti gli utenti e può essere accessibile tramite la console web GDC o utilizzando la riga di comando. I servizi gestiti possono essere software sviluppati da Google o software open source che Google ha integrato con GDC.
Prima di iniziare
Per configurare le policy di rete di creazione dei progetti per i servizi gestiti, devi disporre di quanto segue:
Per impostazione predefinita, un servizio gestito consente solo le connessioni dal progetto che ha creato il servizio. Un operatore può esporre il servizio gestito a progetti diversi da quello che ha creato il servizio utilizzando un criterio di rete del progetto.
Puoi creare un criterio globale per un servizio gestito che
si applica a tutte le zone della tua organizzazione. Per saperne di più sulle risorse globali in un universo GDC, vedi
Panoramica multizona.
Crea una policy globale per un servizio gestito
Il seguente ProjectNetworkPolicy espone il servizio di database (DBS) come servizio gestito:
GLOBAL_API_SERVER: il percorso kubeconfig del server API globale. Per saperne di più, vedi Server API globali e di zona. Se non hai ancora generato un file kubeconfig per il server API, consulta la sezione Accedi per i dettagli.
PROJECT_1: il nome del progetto di origine.
PROJECT_2 il progetto di destinazione. Dopo aver applicato il criterio, i carichi di lavoro nel progetto PROJECT_2 possono connettersi ai carichi di lavoro nel servizio gestito DBS.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[[["\u003cp\u003eThis page outlines how to create project network policies for managed services within Google Distributed Cloud (GDC) air-gapped environments.\u003c/p\u003e\n"],["\u003cp\u003eManaged services, built and maintained by Google, are accessible by default to all users in GDC and can be managed via the web console or command line.\u003c/p\u003e\n"],["\u003cp\u003eBy default, a managed service only allows connections from the project that created it, but a project network policy can expose it to other projects.\u003c/p\u003e\n"],["\u003cp\u003eGlobal project network policies can be created to apply to all zones in an organization, enabling broader access to managed services.\u003c/p\u003e\n"],["\u003cp\u003eThe provided example demonstrates how to use \u003ccode\u003ekubectl\u003c/code\u003e to create a \u003ccode\u003eProjectNetworkPolicy\u003c/code\u003e that allows a specific project to access the Database Service (DBS) managed service.\u003c/p\u003e\n"]]],[],null,["# Create project network policies for managed services\n\nThis page provides instructions to create project network policies for managed services in Google Distributed Cloud (GDC) air-gapped.\nA GDC managed service is a service that is built and maintained by Google. It is available by default to all users and can be accessed through the GDC web console or using the command line. Managed services can be either software developed by Google or open-source software that Google has integrated with GDC.\n\nBefore you begin\n----------------\n\nTo configure create project network policies for managed services, you must have the following:\n\n- The necessary identity and access roles. For more information, see [Prepare predefined roles and access](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/pnp/pnp-overview#prepare-predefined-roles-and-access).\n- An existing project. For more information, see [Create a project](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/create-a-project).\n\nCreate a policy for a managed service\n-------------------------------------\n\nBy default, a managed service only allows connections from the project that\ncreated the service. An operator can expose the managed service to projects\nother than the project that created the service by using a project network\npolicy.\n\nYou can create a global policy for a managed service that\napplies to all zones in your organization. For more information on global resources in a GDC universe, see\n[Multi-zone overview](/distributed-cloud/hosted/docs/latest/gdch/resources/multi-zone/mz-overview).\n\n### Create a global policy for a managed service\n\nThe following `ProjectNetworkPolicy` exposes the Database\nService (DBS) as a managed service: \n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eGLOBAL_API_SERVER\u003c/var\u003e apply -f - \u003c\u003cEOF\n apiVersion: networking.global.gdc.goog/v1\n kind: ProjectNetworkPolicy\n metadata:\n namespace: \u003cvar translate=\"no\"\u003ePROJECT_1\u003c/var\u003e\n name: allow-inbound-traffic-from-project-2-to-dbs-service\n spec:\n subject:\n subjectType: ManagedService\n managedServices:\n matchTypes:\n - 'dbs'\n ingress:\n - from:\n - projectSelector:\n projects:\n matchNames:\n - \u003cvar translate=\"no\"\u003ePROJECT_2\u003c/var\u003e\n EOF\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eGLOBAL_API_SERVER\u003c/var\u003e: the global API server's kubeconfig path. For more information, see [Global and zonal API servers](/distributed-cloud/hosted/docs/latest/gdch/resources/multi-zone/api-servers). If you have not yet generated a kubeconfig file for the API server, see [Sign in](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/sign-in#cli) for details.\n- \u003cvar translate=\"no\"\u003ePROJECT_1\u003c/var\u003e: the source project name.\n- \u003cvar translate=\"no\"\u003ePROJECT_2\u003c/var\u003e the destination project. After applying the policy, workloads in the \u003cvar translate=\"no\"\u003ePROJECT_2\u003c/var\u003e project can connect to workloads in the DBS managed service."]]
