Google Distributed Cloud 部署在本地是自包含的，并且您的本地组件很少与 Google Cloud网络通信。您主要通过连接来进行集群管理。连接的速度、可靠性和安全性并不重要。
您的本地集群是自包含的，但访问 Cloud SQL 之类的 Google 服务除外。您的本地集群和 Google 服务之间的流量使用公共 IP 地址。您可以配置防火墙规则以提供安全性。
高可用性 VPN
借助高可用性 VPN 和 Cloud Router 路由器，Google 与您的本地数据中心之间的流量将遍历公共互联网，但会经过加密。本地组件可以使用专用 IP 地址与云组件进行通信。Cloud Router 路由器会动态地在您的 Google Cloud 网络与您的本地网络之间交换路由。动态路由在您的网络扩展和更改时尤其有用，因为它可以确保将正确的路由状态传播到本地数据中心。
合作伙伴互连
合作伙伴互连通过支持的服务提供商在您的本地网络与Google Cloud 网络之间提供连接。Google 与您的本地数据中心之间的流量不会遍历公开互联网。本地组件可以使用专用 IP 地址与云组件进行通信。您与 Google 之间的连接速度快、安全可靠。
专用互连
专用互连在您的本地网络与Google Cloud 网络之间提供直接物理连接。如果您需要高带宽，则此类连接经济实惠。Google 与您的本地数据中心之间的流量不会遍历公开互联网。本地组件可以使用专用 IP 地址与云组件进行通信。您与 Google 的连接是安全可靠的，甚至比使用合作伙伴互连的连接还要快。
您创建了一个同时具有公共 IP 地址和专用 IP 地址的 Cloud SQL 实例。然后，您的本地组件可以使用其专用 IP 地址访问该 Cloud SQL 实例。在这种情况下，您不需要专用 Google 访问通道，因为您不需要访问 Google 服务的公共 IP 地址。只有在 Cloud Router 路由器将 Cloud SQL 实例的专用 IP 地址通告到本地网络时，此方法才有效。
您在 Google Cloud中拥有 Google Distributed Cloud 集群，并且集群节点具有专用 IP 地址。您的本地组件可以访问云端 Google Distributed Cloud 集群中的 NodePort Service 或内部负载均衡器 Service。
VPC Service Controls
如果您希望增加防护以防止数据渗漏，则可以使用 VPC Service Controls。借助 VPC Service Controls，您可以为 Google 托管服务的资源配置安全边界，并控制跨边界的数据移动。
如果您使用 VPC Service Controls，在运行某些 gkectl 命令时可能会看到错误，例如 "Validation Category: GCP - [UNKNOWN] GCP
service: [Stackdriver] could not get GCP services"。为避免这些错误，请在命令中添加 --skip-validation-gcp 参数。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-01。"],[],[],null,["There are various ways that you can connect Google Distributed Cloud\nclusters, running in your on-premises data center, to the Google Cloud\nnetwork. Possibilities include:\n\n- Regular internet connection\n- [HA VPN](/network-connectivity/docs/vpn/concepts/overview)\n- [Partner Interconnect](/network-connectivity/docs/interconnect/concepts/partner-overview)\n- [Dedicated Interconnect](/network-connectivity/docs/interconnect/concepts/dedicated-overview)\n\nRegular internet connection\n\nIn certain scenarios, you can use the internet as the connection between Google\nand your on-premises data center. For example:\n\n- Your Google Distributed Cloud deployment is self-contained on your premises, and\n your on-premises components seldom communicate with the Google Cloud\n network. You use the connection primarily for cluster management. The speed,\n reliability, and security of the connection are not critical.\n\n- Your on-premises cluster is self-contained, except for access to a Google\n service like Cloud SQL. Traffic between your on-premises cluster and the\n Google service uses public IP addresses. You configure firewall rules to\n provide security.\n\nHA VPN\n\nWith [HA VPN](/vpn/docs/concepts/overview) and\n[Cloud Router](/network-connectivity/docs/router), traffic between Google\nand your on-premises data center traverses the public internet, but is\nencrypted. on-premises components can communicate with cloud components using\nprivate IP addresses. Cloud Router dynamically exchanges routes between your\nGoogle Cloud networks and your on-premises network. Dynamic routing is\nespecially beneficial as your network expands and changes, because it ensures\nthat the correct routing state is propagated to your on-premises data center.\n\nPartner Interconnect\n\n[Partner Interconnect](/network-connectivity/docs/interconnect/concepts/partner-overview)\nprovides connectivity between your on-premises network and the\nGoogle Cloud network through a supported service provider. Traffic\nbetween Google and your on-premises data center does not traverse the public\ninternet. On-premises components can communicate with cloud components using\nprivate IP addresses. Your connection to Google is fast, secure, and reliable.\n\nDedicated Interconnect\n\n[Dedicated Interconnect](/network-connectivity/docs/interconnect/concepts/dedicated-overview)\nprovides a direct physical connection between your on-premises network and the\nGoogle Cloud network. This type of connection can be cost-effective if\nyou need high bandwidth. Traffic between Google and your on-premises data\ncenter does not traverse the public internet. On-premises components can\ncommunicate with cloud components using private IP addresses. Your connection to\nGoogle is secure and reliable, and is even faster than a connection using\nPartner Interconnect.\n\nImpact of a temporary disconnection\n\nFor information on what happens if you're disconnected, see\n[Impact of temporary disconnection from Google Cloud](/anthos/docs/concepts/anthos-connectivity).\n\nChoosing a connection type\n\nFor additional guidance on choosing a connection type, see:\n\n- [Choosing a VPN Routing Option](/network-connectivity/docs/how-to/choose-product#cloud-vpn)\n- [Choose an Interconnect Type](/network-connectivity/docs/how-to/choose-product#cloud-interconnect)\n\nNetwork monitoring\n\nRegardless of how you establish a fundamental connection to Google, you can\nbenefit from insights provided by network logging and monitoring. For more\ninformation, see\n[Logging and monitoring](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/logging-and-monitoring)\n\nfor Google Distributed Cloud.\n\nEnhancing your fundamental connection\n\nAfter your fundamental connection is in place, you can add features that enhance\naccess, security, and visibility. For example, you could enable\n[Private Google Access](/vpc/docs/configure-private-google-access) or\n[Connect](/anthos/multicluster-management/connect/overview).\n\nThe remainder of the guidance in this topic assumes you're using one of the\nfollowing options for your fundamental connection to Google:\n\n- [HA VPN](/network-connectivity/docs/vpn/concepts/overview)\n- [Partner Interconnect](/network-connectivity/docs/interconnect/concepts/partner-overview)\n- [Dedicated Interconnect](/network-connectivity/docs/interconnect/concepts/dedicated-overview)\n\nPrivate Google Access\n\n[Private Google Access](/vpc/docs/configure-private-google-access) enables VMs\nthat have only private IP addresses to reach the IP addresses of [Google APIs\nand services](https://developers.google.com/apis-explorer/). This scenario\nincludes the case where your Google Distributed Cloud cluster nodes have only\nprivate IP addresses. You enable Private Google Access at the subnet level.\n\nWith Private Google Access, requests from your on-premises data center\nto Google services traverse your Cloud Interconnect or\nCloud VPN connection instead of traversing the public internet.\n\nUse Private Google Access in these situations:\n\n- Your on-premises VMs without public IP addresses must connect to Google\n services like BigQuery, Pub/Sub, or Container Registry.\n\n- You want to connect to Google services without traversing the public internet.\n\nFor a list of services that support Google Private Access from on-premises VMs, see\n[Supported services](/vpc/docs/private-google-access-hybrid#supported-services-onprem).\nFor information about using Private Google Access from on-premises VMs, see\n[Configuring Private Google Access for on-premises hosts](/vpc/docs/configure-private-google-access-hybrid).\n\nServices that don't require Google Private Access\n\nSometimes, you don't need Private Google Access to reach a service from a\nVM that has only a private IP address. For example:\n\n- You create a Cloud SQL instance that has both a public IP address and a\n private IP address. Then your on-premises components can access the\n Cloud SQL instance using its private IP address. You don't need\n Private Google Access in this case, because you don't need to reach the\n public IP address of a Google service. This approach works only if\n Cloud Router advertises the private IP address of the\n Cloud SQL instance to your on-premises network.\n\n- You have an Google Distributed Cloud cluster in Google Cloud, and the\n cluster nodes have private IP addresses. Your on-premises components can\n access a NodePort Service or an internal load balancer Service in the cloud\n Google Distributed Cloud cluster.\n\nVPC Service Controls\n\nIf you want added protection against exfiltration, you can use\n[VPC Service Controls](/vpc-service-controls/docs/overview).\nWith VPC Service Controls, you can configure security perimeters around the\nresources of your Google-managed services and control the movement of data\nacross the perimeter boundary.\n\nIf you use VPC Service Controls, you might see errors when you run some\n`gkectl` commands, such as `\"Validation Category: GCP - [UNKNOWN] GCP\nservice: [Stackdriver] could not get GCP services\"`. To avoid these errors, add\nthe `--skip-validation-gcp` parameter to your commands.\n\nConnect\n\n[Connect](/anthos/multicluster-management/connect/overview) enables you\nto view and manage your on-premises user clusters from Google Cloud console.\n| **Note:** Connect is not the fundamental connection between your on-premises data center and Google. Your fundamental connection is formed with [Cloud Interconnect](/network-connectivity/docs/interconnect) or [Cloud VPN](/network-connectivity/docs/vpn/concepts/overview). To provide a view of your on-premises clusters from Google Cloud console, Connect runs on top of your fundamental connection.\n\nWhat's next\n\n- [Logging and monitoring](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/logging-and-monitoring)\n- [Cloud VPN](/network-connectivity/docs/vpn/concepts/overview)\n- [Partner Interconnect](/network-connectivity/docs/interconnect/concepts/partner-overview)\n- [Dedicated Interconnect](/network-connectivity/docs/interconnect/concepts/dedicated-overview)"]]
