httpProxy 및 httpsProxy 필드는 https://로 시작하는 URL을 지원하지 않습니다. http://를 사용해야 합니다. 포트 443 요청에는 HTTPS가 사용됩니다.
httpProxy, httpsProxy, noProxy의 값을 설정해야 합니다.
클러스터의 프록시 구성(리소스 그룹 ID 및 보안 비밀 ID)은 변경할 수 없습니다. 이러한 값을 업데이트하려면 클러스터 및 노드 풀을 새로 만들어야 합니다.
추가 도메인, IP, CIDR을 noProxy 필드에 추가해야 할 수 있습니다. 클러스터의 제어 영역 서브넷 CIDR을 추가하는 것이 좋습니다(포드 주소 CIDR 및 서비스 주소 CIDR이 기본적으로 추가됨).
기본 요건
이 섹션에서는 프록시를 사용하기 전에 적용해야 할 기본 요건을 설명합니다.
Azure Key Vault 구성
GKE on Azure는 Azure Key Vault에 프록시 구성 정보를 저장합니다.
GKE on Azure에 프록시를 구성하려면 Key Vault에 보안 비밀을 만들기 위한 권한이 있어야 합니다. Key Vault는 클러스터의 VNet에서 액세스할 수 있어야 합니다.
프록시 허용 목록
Azure용 GKE에서 Google Cloud 서비스에 연결하려면 프록시 서버에서 특정 Google 및 Microsoft 도메인에 대한 트래픽을 허용해야 합니다.
프록시에서 제외할 쉼표로 구분된 URL 목록입니다. 각 값은 IP 주소, CIDR 범위, 도메인 이름 또는 별표 문자(*)일 수 있습니다. 선행 점으로 지정된 도메인(예: '.google.com')은 하위 도메인이 필요함을 나타냅니다. 단일 별표 *를 사용하면 모든 프록시 구성을 무시합니다.
"1.2.3.4,10.0.0.0/16,example.com,.site.com"
예
구성 파일을 만들려면 httpProxy, noProxy, httpsProxy(선택사항) 키 값이 포함된 JSON 파일을 만듭니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-29(UTC)"],[],[],null,["Use an HTTP proxy\n\nThis document shows you how to route traffic from the GKE on Azure\nthrough an HTTP/HTTPS proxy. You specify proxy configuration when you create\na cluster.\n\nOverview\n\nGKE on Azure can route outbound internet traffic through a proxy for\nthe following reasons:\n\n- To register clusters with Google Cloud through [Connect](/anthos/multicluster-management/connect/overview)\n- To run the Connect Agent\n- To download images from Container Registry\n\nLimitations\n\n- The `httpProxy` and `httpsProxy` fields do not support URLs beginning with `https://`. You must use `http://`. Requests to port 443 use HTTPS.\n- You must set values for `httpProxy`, `httpsProxy`, and `noProxy`.\n- A cluster's proxy configuration--- the resource group ID and secret ID--- is immutable. You must create a new cluster and node pool to update these values.\n- You might need to add additional domains, IPs, or CIDRs to the `noProxy` field. We recommend adding your cluster's control planes subnet CIDRs (Pod address CIDR and Service address CIDR are added by default).\n\nPrerequisites\n\nThis section describes the prerequisites you must apply before using a proxy.\n\nAzure Key Vault configuration\n\nGKE on Azure stores proxy configuration information in Azure Key Vault.\nTo configure a proxy with GKE on Azure, you need to have\npermissions to create a secret in a Key Vault. The Key Vault must be accessible\nfrom your cluster's VNet.\n\nProxy Allowlist\n\nFor GKE on Azure to connect to Google Cloud services,\nthe proxy server must allow traffic to specific Google and Microsoft domains. \n\n .azure.com\n .gcr.io\n cloudresourcemanager.googleapis.com\n container.googleapis.com\n gkeconnect.googleapis.com\n gkehub.googleapis.com\n oauth2.googleapis.com\n securetoken.googleapis.com\n storage.googleapis.com\n sts.googleapis.com\n www.googleapis.com\n servicecontrol.googleapis.com\n logging.googleapis.com\n monitoring.googleapis.com\n opsconfigmonitoring.googleapis.com\n \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-nf\"\u003eGCP_LOCATION\u003c/span\u003e\u003c/var\u003e-gkemulticloud.googleapis.com\n\nReplace \u003cvar translate=\"no\"\u003eGCP_LOCATION\u003c/var\u003e with the Google Cloud region in\nwhich your cluster resides. Specify `us-west1` or another\n[supported region](/kubernetes-engine/multi-cloud/docs/azure/reference/supported-regions).\n\nSubnet Network Security Group requirement\n\nIf you're using Network Security Groups (NSGs) to manage traffic to your subnets,\nyour NSG rules must allow outgoing TCP traffic to following destinations:\n\n- AzureCloud: TCP, port 80 and 443\n\nSee [Azure service tags](https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview#available-service-tags)\nfor more information about using service tags with NSGs.\n\n\nCreate a proxy configuration file\n\nThe proxy configuration is stored in an Azure Key Vault secret as a JSON string.\nYou can pass this configuration to the `az` command-line tool as a\nfile. This section describes how to create that file.\n\nThe following table describes the contents of this file.\n\n| **Field** | **Description** | **Examples** | **Required** |\n|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------|--------------|\n| `httpProxy` | A proxy server URL. The value should include a hostname/IP address and optionally a port, username, and password. | `\"http://user:password@10.184.37.42:80\"` `\"10.184.37.42\"` | Yes |\n| `httpsProxy` | A proxy URL for encrypted, HTTPS traffic. The httpProxy URL will be used if httpsProxy has an empty value. | `\"http://10.101.16.31:80\"` | Yes |\n| `noProxy` | A comma-separated list of URLs to exclude from proxying. Each value can be an IP address, a CIDR range, a domain name, or the asterix character (\\*). Domains specified with a leading dot (for example, \\`.google.com\\`) indicate that a subdomain is required. A single asterix \\* ignores all proxy configuration. | `\"1.2.3.4,10.0.0.0/16,example.com,.site.com\"` | Yes |\n\n1. To create the configuration file, create a JSON file that contains values for\n `httpProxy`, `noProxy`, and optional `httpsProxy` keys.\n\n ```json\n {\n \"httpProxy\": \"AUTHENTICATION_URL\",\n \"httpsProxy\": \"AUTHENTICATION_URL\",\n \"noProxy\": \"NO_PROXY_ADDRESSES\"\n }\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eAUTHENTICATION_URL\u003c/var\u003e: Encoded URL containing the proxy username and the password\n - \u003cvar translate=\"no\"\u003eNO_PROXY_ADDRESSES\u003c/var\u003e: Comma-separated list of CIDR blocks and URLs--- for example `10.0.0.0/16,http://example.com`\n\n Save the file to use in the following section.\n2. Create a secret with this JSON data as a secret in Azure Key Vault using\n the `az` command-line tool.\n\n az keyvault secret set --name \u003cvar translate=\"no\"\u003eSECRET_NAME\u003c/var\u003e \\\n --vault-name \u003cvar translate=\"no\"\u003eKEY_VAULT_NAME\u003c/var\u003e \\\n --file \u003cvar translate=\"no\"\u003ePROXY_CONFIGURATION_FILE\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eSECRET_NAME\u003c/var\u003e: the name of the new secret\n - \u003cvar translate=\"no\"\u003eKEY_VAULT_NAME\u003c/var\u003e: the name of your Key Vault\n - \u003cvar translate=\"no\"\u003ePROXY_CONFIGURATION_FILE\u003c/var\u003e: the path to your\n proxy configuration file.\n\n The output includes the secret's name and contents. You can now\n reference this secret when you create a cluster.\n\nCreate a cluster that uses a proxy\n\nTo configure GKE on Azure to use an HTTP proxy for outbound\nconnectivity, perform the following steps:\n\nFollow the steps in\n[Create a cluster and node pool](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-cluster)\nand pass the `--proxy-resource-group-id` and `--proxy-secret-id` flags. \n\n gcloud container azure clusters create \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --proxy-resource-group-id=\u003cvar translate=\"no\"\u003ePROXY_RESOURCE_GROUP_ID\u003c/var\u003e \\\n --proxy-secret-id=\u003cvar translate=\"no\"\u003ePROXY_SECRET_ID\u003c/var\u003e\n ...\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: your cluster's name\n- \u003cvar translate=\"no\"\u003ePROXY_RESOURCE_GROUP_ID\u003c/var\u003e: the resource group that hosts your cluster\n- \u003cvar translate=\"no\"\u003ePROXY_SECRET_ID\u003c/var\u003e: the ID of the secret that contains your proxy configuration--- for example, `https://`\u003cvar translate=\"no\"\u003eVAULT_NAME\u003c/var\u003e`.vault.azure.net/secrets/`\u003cvar translate=\"no\"\u003eSECRET_NAME\u003c/var\u003e`/`\u003cvar translate=\"no\"\u003eSECRET_VERSION\u003c/var\u003e\n\nWhat's next\n\n- Read additional information on how to [Create a cluster](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-cluster)."]]
