如果網路設定允許傳出要求，您可以設定讓 Connect Agent 掃遍 NAT、輸出 Proxy 和防火牆，從而在叢集的 Kubernetes API 伺服器和 Google Cloud 專案之間建立長時間有效的連線。啟用這項連線後，您就能使用自己的憑證重新登入叢集，並存取 Kubernetes 資源的詳細資料。這項功能可有效複製 UI 體驗，否則只有 GKE 叢集才能使用。
建立連線後，Connect Agent 軟體就能互換帳戶憑證、技術詳細資料，以及使用 Google Cloud管理連線基礎架構和工作負載所需的中繼資料，包括資源、應用程式及硬體的詳細資料。
此叢集服務資料與您的 Google Cloud 專案和帳戶相關。Google 會使用這項資料，在叢集和 Google Cloud之間維護控制平面，提供您要求的任何 Google Cloud服務和功能，包括協助支援、計費、提供更新，以及評估並提升 Connect 和 Google Cloud 服務的可靠性、品質、容量和功能。
您仍然可以控制透過 Connect 傳送的資料：您的 Kubernetes API 伺服器會針對經由 Connect 提出的所有要求執行驗證、授權與稽核記錄。Google 和使用者經叢集管理員授權後即可透過 Connect 存取資料或 API (例如透過 RBAC)；叢集管理員可以撤銷授權。
您需要提供特定的 IAM 角色，才能啟動 Connect 代理程式，並使用 Google Cloud 控制台或 Google Cloud CLI 與叢集互動。這些角色無法直接存取已連線的叢集。如要進一步瞭解如何從 Google Cloud 控制台登入叢集，請參閱「從 Google Cloud 控制台使用叢集」。
其中部分角色允許您存取叢集相關資訊，其中包括：
叢集名稱
公開金鑰
IP 位址
識別資訊提供者
Kubernetes 版本
叢集大小
其他叢集中繼資料
Connect 使用下列 IAM 角色：
角色名稱
角色稱號
說明
權限
roles/gkehub.editor
Hub 編輯者
提供 GKE Hub 資源的編輯權限。
「 Google Cloud」的權限
resourcemanager.projects.get
resourcemanager.projects.list
Hub 權限
gkehub.memberships.list
gkehub.memberships.get
gkehub.memberships.create
gkehub.memberships.update
gkehub.memberships.delete
gkehub.memberships.generateConnectManifest
gkehub.memberships.getIamPolicy
gkehub.locations.list
gkehub.locations.get
gkehub.operations.list
gkehub.operations.get
gkehub.operations.cancel
gkehub.features.list
gkehub.features.get
gkehub.features.create
gkehub.features.update
gkehub.features.delete
gkehub.features.getIamPolicy
gkehub.fleet.*
gkehub.membershipfeatures.list
gkehub.membershipfeatures.get
gkehub.membershipfeatures.create
gkehub.membershipfeatures.update
gkehub.membershipfeatures.delete
roles/gkehub.viewer
Hub 檢視者
提供 Hub 和相關資源的唯讀存取權。
「 Google Cloud」的權限
resourcemanager.projects.get
resourcemanager.projects.list
Hub 權限
gkehub.memberships.list
gkehub.memberships.get
gkehub.memberships.generateConnectManifest
gkehub.memberships.getIamPolicy
gkehub.locations.list
gkehub.locations.get
gkehub.operations.list
gkehub.operations.get
gkehub.features.list
gkehub.features.get
gkehub.features.getIamPolicy
gkehub.membershipfeatures.list
gkehub.membershipfeatures.get
roles/gkehub.connect
GKE Connect 代理人
提供在外部叢集和 Google 之間建立新連線的能力。
gkehub.endpoints.connect
資源使用情況和需求
通常在註冊時安裝的 Connect 代理程式會使用 500m 的 CPU 和 200Mi 的記憶體。不過，實際用量會因每秒向虛擬服務專員提出的要求數量和大小而異。這些因素會受到許多因素影響，包括叢集大小、透過 Google Cloud 控制台存取叢集的使用者人數 (使用者和/或工作負載越多，要求就越多)，以及叢集上的啟用 Fleet 的功能數量。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["When you register a cluster outside Google Cloud to your fleet, Google Cloud uses a [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) called the *Connect Agent* to\nestablish a connection between the cluster and your Google Cloud\nproject, and to handle Kubernetes requests. The Connect Agent is not required to establish a connection for GKE clusters running in Google Cloud.\n\nThis enables access to cluster and to workload management\nfeatures in Google Cloud, including a unified user interface,\n[Google Cloud console](/cloud-console), to interact with your cluster.\n\nIf your network is configured to allow outbound requests, you can configure the\nConnect Agent to traverse NATs, egress proxies, and firewalls to establish\na long-lived, encrypted connection between your cluster's Kubernetes API server\nand your Google Cloud project. Once this connection is enabled, you can\nuse your own credentials to log back into your clusters and access details\nabout their Kubernetes resources. This effectively replicates the UI experience\nthat is otherwise only available to GKE clusters.\n\nAfter the connection is established, the Connect Agent software can exchange\naccount credentials, technical details, and metadata about connected\ninfrastructure and workloads necessary to manage them with Google Cloud,\nincluding the details of resources, applications, and hardware.\n\nThis cluster service data is associated with your Google Cloud project\nand account. Google uses this data to maintain a control plane between your\ncluster and Google Cloud, to provide you with any Google Cloud\nservices and features you request, including facilitating support, billing,\nproviding updates, and to measure and improve the reliability, quality,\ncapacity, and functionality of Connect and Google Cloud services\navailable through Connect.\n\nYou remain in control of what data is sent through Connect: your\nKubernetes API server performs [authentication](https://kubernetes.io/docs/reference/access-authn-authz/authentication/),\n[authorization](https://kubernetes.io/docs/reference/access-authn-authz/authorization/), and [audit logging](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/) on all requests via\nConnect. Google and users can access data or APIs via Connect\nafter they have been authorized by the cluster administrator (for example, via\n[RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)); the cluster administrator can revoke that authorization.\n\nConnect IAM roles\n\n[Identity and Access Management (IAM)](/iam/docs) allows users, groups, and\nservice accounts to access Google Cloud APIs and to perform tasks within\nGoogle Cloud products.\n\nYou need to provide specific IAM\n[roles](/iam/docs/understanding-roles) to launch the Connect Agent and\ninteract with your cluster using the Google Cloud console or Google Cloud CLI. These\nroles do not allow direct access to connected clusters. You can learn more about\nlogging in to clusters from the Google Cloud console in [Working with clusters from the Google Cloud console](/kubernetes-engine/fleet-management/docs/console).\n\nSome of these roles allow you to access information about clusters, including:\n\n- Cluster names\n- Public keys\n- IP addresses\n- Identity providers\n- Kubernetes versions\n- Cluster size\n- Other cluster metadata\n\nConnect uses the following IAM roles:\n\n| Role name | Role title | Description | Permissions |\n|------------------------|-------------------|-------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `roles/gkehub.editor` | Hub Editor | Provides edit access to GKE Hub resources. | **Permissions for Google Cloud** - resourcemanager.projects.get - resourcemanager.projects.list **Permissions for Hub** - gkehub.memberships.list - gkehub.memberships.get - gkehub.memberships.create - gkehub.memberships.update - gkehub.memberships.delete - gkehub.memberships.generateConnectManifest - gkehub.memberships.getIamPolicy - gkehub.locations.list - gkehub.locations.get - gkehub.operations.list - gkehub.operations.get - gkehub.operations.cancel - gkehub.features.list - gkehub.features.get - gkehub.features.create - gkehub.features.update - gkehub.features.delete - gkehub.features.getIamPolicy - gkehub.fleet.\\* - gkehub.membershipfeatures.list - gkehub.membershipfeatures.get - gkehub.membershipfeatures.create - gkehub.membershipfeatures.update - gkehub.membershipfeatures.delete |\n| `roles/gkehub.viewer` | Hub Viewer | Provide read-only access to Hub and related resources. | **Permissions for Google Cloud** - resourcemanager.projects.get - resourcemanager.projects.list **Permissions for Hub** - gkehub.memberships.list - gkehub.memberships.get - gkehub.memberships.generateConnectManifest - gkehub.memberships.getIamPolicy - gkehub.locations.list - gkehub.locations.get - gkehub.operations.list - gkehub.operations.get - gkehub.features.list - gkehub.features.get - gkehub.features.getIamPolicy - gkehub.membershipfeatures.list - gkehub.membershipfeatures.get |\n| `roles/gkehub.connect` | GKE Connect Agent | Provides ability to establish new connections between external clusters and Google. | gkehub.endpoints.connect |\n\nResource usage and requirements\n\nTypically the Connect agent installed at registration uses 500m of CPU and 200Mi of memory. However, this usage can vary depending on the number of requests being made to the agent per second, and the size of those requests. These can be affected by a number of factors, including the size of the cluster, the number of users accessing the cluster via the Google Cloud console (the more users and/or workloads, the more requests), and the number of [fleet-enabled features](/kubernetes-engine/fleet-management/docs/fleet-concepts#fleet-enabled-components) on the cluster."]]
