[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Using a proxy with GKE on AWS\n\nThis topic shows you how to route traffic from the\nGKE on AWS management service and Connect\nthrough an HTTP/HTTPS proxy.\n\nGKE on AWS requires internet access for the following\nreasons:\n\n- The management service registers user clusters with [Connect](/anthos/multicluster-management/connect/overview).\n- User clusters run the Connect Agent.\n- All management service and user cluster nodes download images from Container Registry.\n\nYou can route this traffic through an HTTP or HTTPS proxy. As of\nGKE on AWS 1.8, you can configure individual proxy settings\nfor your management service and each of your clusters. For more information on\nhow to change proxy settings, see\n[Changing cluster proxy settings](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/changing-proxy-settings).\n\nYou declare proxy settings in a JSON file that is referenced in\n[`anthos-gke.yaml`](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/awsmanagementservice).\n\nPrerequisites\n-------------\n\nBefore you configure GKE on AWS to use a proxy, you must enable\nAWS VPC endpoints, define a security group for the proxy, and allow outbound\nconnections to certain Google Cloud services.\n\nTo use an HTTP proxy, your user clusters must be running Kubernetes\n1.17 or higher.\n\n### Enable VPC endpoints\n\nBefore you configure a proxy, you must create\n[VPC endpoints](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html)\nfor your GKE on AWS installation. VPC endpoints let resources in\nprivate subnets access AWS services without public internet access.\n\nThe following table lists the AWS services that GKE on AWS\nrequires VPC endpoints for, along with the type of endpoint and the\n[Security Groups](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/security-groups) for\neach GKE on AWS component that requires access to the endpoint.\n\n| **Important:** Enable [Private DNS](https://docs.aws.amazon.com/vpc/latest/privatelink/endpoint-services-overview.html) (also called **Enable DNS name** on the AWS console) on interface endpoints.\n\nYou can create endpoints from the AWS\n[VPC Console](https://console.aws.amazon.com/vpc/home). The\noptions you set when creating VPC endpoints depend on your VPC configuration.\n\n### Define a security group\n\nYour GKE on AWS components must be able to connect to the proxy\nserver. Create or locate an AWS\n[security group](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)\nthat allows outbound connections to your proxy server. The security group should\nallow outbound access from your Management, Control plane, and Node pool security\ngroups to the proxy address and port. Save the ID of this security group\n(for example, `sg-12345678`).\n\n### Allow outbound connections to Google Cloud services\n\nFor GKE on AWS to connect to Google Cloud services,\nthe proxy server must allow traffic to the following domains:\n\n- `gkeconnect.googleapis.com`\n- `gkehub.googleapis.com`\n- `oauth2.googleapis.com`\n- `storage.googleapis.com`\n- `www.googleapis.com`\n- `gcr.io`\n- `k8s.gcr.io`\n- \u003cvar translate=\"no\"\u003eEC2-REGION\u003c/var\u003e`.ec2.archive.ubuntu.com`\n\nReplace \u003cvar translate=\"no\"\u003eEC2-REGION\u003c/var\u003e with the AWS EC2 region where your\nGKE on AWS installation runs. For example,\n`us-west-1.ec2.archive.ubuntu.com/`.\n\nIf you are using\n[Cloud Service Mesh with Prometheus and Kiali](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/ingress),\nallow outbound access from the following domains:\n\n- `docker.io`\n- `quay.io`\n\nCreating the proxy configuration JSON file\n------------------------------------------\n\nThe proxy configuration JSON file contains one object that contains three\nkey/value pairs, with key names `httpProxy`, `httpsProxy`, and `noProxy`.\nUsernames and passwords are envelope-encrypted with your\n[AWS KMS key](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/awsmanagementservice#speckmskeyarn) before\napplying them to the server. \n\n {\n \"httpProxy\": \"\u003cvar translate=\"no\"\u003eHTTP_PROXY\u003c/var\u003e\",\n \"httpsProxy\": \"\u003cvar translate=\"no\"\u003eHTTPS_PROXY\u003c/var\u003e\",\n \"noProxy\": \"\u003cvar translate=\"no\"\u003eNO_PROXY\u003c/var\u003e\"\n }\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eHTTP_PROXY\u003c/var\u003e with the proxy server address to route HTTP requests through.\n- \u003cvar translate=\"no\"\u003eHTTPS_PROXY\u003c/var\u003e with the proxy server to route HTTPS requests through.\n- \u003cvar translate=\"no\"\u003eNO_PROXY\u003c/var\u003e with an optional list of IPs, CIDR ranges, and domains where proxy is not used.\n\nSee [Configuration reference](#configuration_reference) for more information.\nFor example, the following configuration uses a proxy at `10.0.0.254` and\nexcludes a number of sites. \n\n {\n \"httpProxy\": \"http://user:password@10.0.0.254:80\",\n \"httpsProxy\": \"http://user:password@10.0.0.254:443\",\n \"noProxy\": \"localhost,127.0.0.1,169.254.169.254,10.0.0.0/16,example.com\"\n }\n\nAdding the proxy to anthos-gke.yaml\n-----------------------------------\n\nConfigure your AWSManagementService by performing the following steps:\n\n1. Change to the directory with your GKE on AWS configuration.\n You created this directory when\n [Installing the management service](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/installing-management).\n\n ```sh\n cd anthos-aws\n ```\n\n \u003cbr /\u003e\n\n2. Open `anthos-gke.yaml` in a text editor. Add a value for `spec.proxy`\n as in the following example.\n\n apiVersion: multicloud.cluster.gke.io/v1\n kind: AWSManagementService\n metadata:\n name: management\n spec:\n version: aws-1.14.1-gke.0\n proxy: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003ePROXY_JSON_FILE\u003c/span\u003e\u003c/var\u003e\n securityGroupIDs:\n - \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eSECURITY_GROUP_ID\u003c/span\u003e\u003c/var\u003e\n ...\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROXY_JSON_FILE\u003c/var\u003e with the relative path of your proxy's JSON configuration.\n - \u003cvar translate=\"no\"\u003eSECURITY_GROUP_ID\u003c/var\u003e with the ID of a security group with [access\n to the proxy server](#define_a_security_group).\n\n Save the file.\n3. Run `anthos-gke aws management init` to generate an `anthos-gke.status.yaml`\n file with additional configuration. The `init` command also validates the\n `AWSManagementService` object in your `anthos-gke.yaml` file.\n\n anthos-gke aws management init\n\n4. Run `anthos-gke aws management apply` to update your management service on\n AWS.\n\n anthos-gke aws management apply\n\n5. Next, [Create a user\n cluster](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/creating-custom-user-cluster). Include the\n proxy's security group in the `AWSCluster` and `AWSNodePool`'s\n `spec.controlPlane.securityGroupIDs` and `spec.securityGroupIDs`,\n respectively. The cluster then has access to the proxy.\n\nConfiguration reference\n-----------------------\n\nWhat's next\n-----------\n\nFor more information about completing a GKE on AWS installation, see the following:\n\n- If you need to create a dedicated AWS VPC, see [Installing a management service](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/installing-management).\n\n- If you have an existing AWS VPC, see [Integrating with existing infrastructure](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/integrating-existing-infrastructure).\n\nFor information about changing your cluster's proxy settings, see:\n\n- [Changing cluster proxy settings](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/changing-proxy-settings)"]]
