Error yang mirip dengan berikut dapat terjadi saat Anda mencoba membuat cluster GKE publik:
Constraint constraints/compute.vmExternalIpAccess violated for project
Hal ini hanya memengaruhi cluster GKE publik, termasuk cluster Autopilot GKE.
Saat Anda membuat cluster GKE publik, VM Compute Engine yang mendasarinya, yang menjadi bagian dari worker node cluster ini, akan diberikan alamat IP eksternal.
Jika Anda mengonfigurasi batasan kebijakan organisasi
constraints/compute.vmExternalIpAccess
ke Deny All atau untuk membatasi alamat IP eksternal ke instance VM tertentu di
level organisasi, folder, atau project, maka
kebijakan tersebut akan mencegah worker node GKE mendapatkan alamat IP
eksternal, yang mengakibatkan terjadinya kegagalan pembuatan cluster.
Untuk menemukan log operasi pembuatan cluster, Anda dapat meninjau
Log Audit Operasi Cluster GKE menggunakan
Logs Explorer dengan kueri
penelusuran yang mirip dengan berikut ini:
Untuk mengatasi masalah ini, pastikan kebijakan yang efektif untuk batasan
constraints/compute.vmExternalIpAccess adalah Allow All di project tempat Anda
mencoba membuat cluster publik GKE. Untuk mengetahui informasi tentang cara mengatasi batasan ini, lihat Membatasi alamat IP eksternal ke instance VM tertentu.
Setelah menyetel batasan ke Allow All, hapus cluster yang gagal dan
buat cluster baru. Hal ini diperlukan karena cluster yang gagal tidak dapat diperbaiki.
Langkah berikutnya
Jika Anda tidak dapat menemukan solusi untuk masalah Anda dalam dokumentasi, lihat Mendapatkan dukungan untuk mendapatkan bantuan lebih lanjut, termasuk saran tentang topik berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-01 UTC."],[],[],null,["# Troubleshoot cluster creation\n\n[Autopilot](/kubernetes-engine/docs/concepts/autopilot-overview) [Standard](/kubernetes-engine/docs/concepts/choose-cluster-mode)\n\n*** ** * ** ***\n\nThis page shows you how to resolve issues with creating clusters in\nGoogle Kubernetes Engine (GKE).\n\nFor general issues with a Kubernetes cluster, see\n[Troubleshooting Clusters](https://kubernetes.io/docs/tasks/debug/debug-cluster/)\nin the Kubernetes documentation.\n\nError: Constraint constraints/compute.vmExternalIpAccess violated\n-----------------------------------------------------------------\n\nAn error similar to the following can occur when you try to create a public\nGKE cluster: \n\n Constraint constraints/compute.vmExternalIpAccess violated for project\n\nThis only affects public GKE clusters, including\nGKE Autopilot clusters.\n\nWhen you create public GKE clusters, the underlying\nCompute Engine VMs, which make up the worker nodes of this cluster, have\n[external IP addresses](/compute/docs/ip-addresses#externaladdresses) assigned.\nIf you configure the organization policy constraint\n[`constraints/compute.vmExternalIpAccess`](/resource-manager/docs/organization-policy/org-policy-constraints)\nto `Deny All` or to restrict external IP addresses to specific VM instances at\nthe organization, folder, or project level, then the\npolicy prevents the GKE worker nodes from obtaining external IP\naddresses, which results in cluster creation failure.\n\nTo find the logs of the cluster creation operation, you can review the\n[GKE Cluster Operations Audit Logs](/kubernetes-engine/docs/how-to/audit-logging) using\n[Logs Explorer](/logging/docs/view/logs-explorer-interface) with a search\nquery similar to the following: \n\n resource.type=\"gke_cluster\"\n logName=\"projects/test-last-gke-sa/logs/cloudaudit.googleapis.com%2Factivity\"\n protoPayload.methodName=\"google.container.v1beta1.ClusterManager.CreateCluster\"\n resource.labels.cluster_name=\"\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e\"\n resource.labels.project_id=\"\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\"\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003e\u003ccode translate=\"no\" dir=\"ltr\"\u003eCLUSTER_NAME\u003c/code\u003e\u003c/var\u003e: the name of the cluster that wasn't created.\n- \u003cvar translate=\"no\"\u003e\u003ccode translate=\"no\" dir=\"ltr\"\u003ePROJECT_ID\u003c/code\u003e\u003c/var\u003e: your project ID.\n\nTo resolve this issue, ensure that the effective policy for the constraint\n`constraints/compute.vmExternalIpAccess` is `Allow All` on the project where you\nare trying to create a GKE public cluster. For information on\nworking with this constraint, see\n[Restricting external IP addresses to specific VM instances](/compute/docs/ip-addresses/configure-static-external-ip-address#disableexternalip).\n\nAfter setting the constraint to `Allow All`, delete the failed cluster and\ncreate a new cluster. This is required because repairing the failed cluster is\nnot possible.\n\nWhat's next\n-----------\n\n- If you can't find a solution to your problem in the documentation, see\n [Get support](/kubernetes-engine/docs/getting-support) for further help,\n including advice on the following topics:\n\n - Opening a support case by contacting [Cloud Customer Care](/support-hub).\n - Getting support from the community by [asking questions on StackOverflow](http://stackoverflow.com/questions/tagged/google-kubernetes-engine) and using the `google-kubernetes-engine` tag to search for similar issues. You can also join the [`#kubernetes-engine` Slack channel](https://googlecloud-community.slack.com/messages/C0B9GKTKJ/) for more community support.\n - Opening bugs or feature requests by using the [public issue tracker](/support/docs/issue-trackers)."]]
