이 페이지에서는 Google Distributed Cloud (GDC) 에어 갭에서 관리 서비스의 프로젝트 네트워크 정책을 만드는 방법을 설명합니다.
GDC 관리형 서비스는 Google에서 빌드하고 유지관리하는 서비스입니다. 모든 사용자가 기본적으로 사용할 수 있으며 GDC 웹 콘솔을 통해 또는 명령줄을 사용하여 액세스할 수 있습니다. 관리형 서비스는 Google에서 개발한 소프트웨어이거나 Google에서 GDC와 통합한 오픈소스 소프트웨어일 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis page outlines how to create project network policies for managed services within Google Distributed Cloud (GDC) air-gapped environments.\u003c/p\u003e\n"],["\u003cp\u003eManaged services, built and maintained by Google, are accessible by default to all users in GDC and can be managed via the web console or command line.\u003c/p\u003e\n"],["\u003cp\u003eBy default, a managed service only allows connections from the project that created it, but a project network policy can expose it to other projects.\u003c/p\u003e\n"],["\u003cp\u003eGlobal project network policies can be created to apply to all zones in an organization, enabling broader access to managed services.\u003c/p\u003e\n"],["\u003cp\u003eThe provided example demonstrates how to use \u003ccode\u003ekubectl\u003c/code\u003e to create a \u003ccode\u003eProjectNetworkPolicy\u003c/code\u003e that allows a specific project to access the Database Service (DBS) managed service.\u003c/p\u003e\n"]]],[],null,["# Create project network policies for managed services\n\nThis page provides instructions to create project network policies for managed services in Google Distributed Cloud (GDC) air-gapped.\nA GDC managed service is a service that is built and maintained by Google. It is available by default to all users and can be accessed through the GDC web console or using the command line. Managed services can be either software developed by Google or open-source software that Google has integrated with GDC.\n\nBefore you begin\n----------------\n\nTo configure create project network policies for managed services, you must have the following:\n\n- The necessary identity and access roles. For more information, see [Prepare predefined roles and access](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/pnp/pnp-overview#prepare-predefined-roles-and-access).\n- An existing project. For more information, see [Create a project](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/create-a-project).\n\nCreate a policy for a managed service\n-------------------------------------\n\nBy default, a managed service only allows connections from the project that\ncreated the service. An operator can expose the managed service to projects\nother than the project that created the service by using a project network\npolicy.\n\nYou can create a global policy for a managed service that\napplies to all zones in your organization. For more information on global resources in a GDC universe, see\n[Multi-zone overview](/distributed-cloud/hosted/docs/latest/gdch/resources/multi-zone/mz-overview).\n\n### Create a global policy for a managed service\n\nThe following `ProjectNetworkPolicy` exposes the Database\nService (DBS) as a managed service: \n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eGLOBAL_API_SERVER\u003c/var\u003e apply -f - \u003c\u003cEOF\n apiVersion: networking.global.gdc.goog/v1\n kind: ProjectNetworkPolicy\n metadata:\n namespace: \u003cvar translate=\"no\"\u003ePROJECT_1\u003c/var\u003e\n name: allow-inbound-traffic-from-project-2-to-dbs-service\n spec:\n subject:\n subjectType: ManagedService\n managedServices:\n matchTypes:\n - 'dbs'\n ingress:\n - from:\n - projectSelector:\n projects:\n matchNames:\n - \u003cvar translate=\"no\"\u003ePROJECT_2\u003c/var\u003e\n EOF\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eGLOBAL_API_SERVER\u003c/var\u003e: the global API server's kubeconfig path. For more information, see [Global and zonal API servers](/distributed-cloud/hosted/docs/latest/gdch/resources/multi-zone/api-servers). If you have not yet generated a kubeconfig file for the API server, see [Sign in](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/sign-in#cli) for details.\n- \u003cvar translate=\"no\"\u003ePROJECT_1\u003c/var\u003e: the source project name.\n- \u003cvar translate=\"no\"\u003ePROJECT_2\u003c/var\u003e the destination project. After applying the policy, workloads in the \u003cvar translate=\"no\"\u003ePROJECT_2\u003c/var\u003e project can connect to workloads in the DBS managed service."]]
