Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Menggunakan proxy HTTP
Dokumen ini menunjukkan cara merutekan traffic dari GKE di Azure
melalui proxy HTTP/HTTPS. Anda menentukan konfigurasi proxy saat membuat
cluster.
Ringkasan
GKE di Azure dapat merutekan traffic internet keluar melalui proxy karena
alasan berikut:
Untuk mendaftarkan cluster dengan Google Cloud melalui
Connect
Untuk menjalankan Connect Agent
Untuk mendownload image dari Container Registry
Batasan
Kolom httpProxy dan httpsProxy tidak mendukung URL yang diawali dengan
https://. Anda harus menggunakan http://. Permintaan ke port 443 menggunakan HTTPS.
Anda harus menetapkan nilai untuk httpProxy, httpsProxy, dan noProxy.
Konfigurasi proxy cluster—ID grup resource dan ID rahasia—tidak dapat diubah. Anda harus membuat cluster dan node pool baru untuk memperbarui nilai ini.
Anda mungkin perlu menambahkan domain, IP, atau CIDR tambahan ke kolom noProxy
field. Sebaiknya tambahkan CIDR subnet bidang kontrol cluster Anda (CIDR alamat Pod dan CIDR alamat Layanan ditambahkan secara default).
Prasyarat
Bagian ini menjelaskan prasyarat yang harus Anda terapkan sebelum menggunakan proxy.
Konfigurasi Azure Key Vault
GKE on Azure menyimpan informasi konfigurasi proxy di Azure Key Vault.
Untuk mengonfigurasi proxy dengan GKE di Azure, Anda harus memiliki
izin untuk membuat secret di Key Vault. Key Vault harus dapat diakses dari VNet cluster Anda.
Daftar yang Diizinkan Proxy
Agar GKE di Azure dapat terhubung ke layanan Google Cloud , server proxy harus mengizinkan traffic ke domain Google dan Microsoft tertentu.
Ganti GCP_LOCATION dengan Google Cloud region tempat cluster GKE Enterprise Anda berada. Tentukan us-west1 atau
wilayah yang didukung lainnya.
Persyaratan Network Security Group Subnet
Jika Anda menggunakan Network Security Group (NSG) untuk mengelola traffic ke subnet, aturan NSG Anda harus mengizinkan traffic TCP keluar ke tujuan berikut:
AzureCloud: TCP, port 80 dan 443
Lihat Tag layanan Azure
untuk mengetahui informasi selengkapnya tentang penggunaan tag layanan dengan NSG.
Membuat file konfigurasi proxy
Konfigurasi proxy disimpan dalam secret Azure Key Vault sebagai string JSON.
Anda dapat meneruskan konfigurasi ini ke alat command line az sebagai
file. Bagian ini menjelaskan cara membuat file tersebut.
Tabel berikut menjelaskan isi file ini.
Kolom
Deskripsi
Contoh
Wajib
httpProxy
URL server proxy. Nilai harus menyertakan nama host/alamat IP dan
opsionalnya port, nama pengguna, dan sandi.
URL proxy untuk traffic HTTPS yang terenkripsi. URL httpProxy akan digunakan jika
httpsProxy memiliki nilai kosong.
"http://10.101.16.31:80"
Ya
noProxy
Daftar URL yang dipisahkan koma untuk dikecualikan dari proxy. Setiap nilai dapat berupa
alamat IP, rentang CIDR, nama domain, atau karakter asteris (*).
Domain yang ditentukan dengan titik di depannya (misalnya, `.google.com`) menunjukkan
bahwa subdomain diperlukan. Satu tanda bintang * mengabaikan semua konfigurasi proxy.
"1.2.3.4,10.0.0.0/16,example.com,.site.com"
Ya
Untuk membuat file konfigurasi, buat file JSON yang berisi nilai untuk
httpProxy, noProxy, dan kunci httpsProxy opsional.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-07-22 UTC."],[],[],null,["Use an HTTP proxy\n\nThis document shows you how to route traffic from the GKE on Azure\nthrough an HTTP/HTTPS proxy. You specify proxy configuration when you create\na cluster.\n\nOverview\n\nGKE on Azure can route outbound internet traffic through a proxy for\nthe following reasons:\n\n- To register clusters with Google Cloud through [Connect](/anthos/multicluster-management/connect/overview)\n- To run the Connect Agent\n- To download images from Container Registry\n\nLimitations\n\n- The `httpProxy` and `httpsProxy` fields do not support URLs beginning with `https://`. You must use `http://`. Requests to port 443 use HTTPS.\n- You must set values for `httpProxy`, `httpsProxy`, and `noProxy`.\n- A cluster's proxy configuration--- the resource group ID and secret ID--- is immutable. You must create a new cluster and node pool to update these values.\n- You might need to add additional domains, IPs, or CIDRs to the `noProxy` field. We recommend adding your cluster's control planes subnet CIDRs (Pod address CIDR and Service address CIDR are added by default).\n\nPrerequisites\n\nThis section describes the prerequisites you must apply before using a proxy.\n\nAzure Key Vault configuration\n\nGKE on Azure stores proxy configuration information in Azure Key Vault.\nTo configure a proxy with GKE on Azure, you need to have\npermissions to create a secret in a Key Vault. The Key Vault must be accessible\nfrom your cluster's VNet.\n\nProxy Allowlist\n\nFor GKE on Azure to connect to Google Cloud services,\nthe proxy server must allow traffic to specific Google and Microsoft domains. \n\n .azure.com\n .gcr.io\n cloudresourcemanager.googleapis.com\n container.googleapis.com\n gkeconnect.googleapis.com\n gkehub.googleapis.com\n oauth2.googleapis.com\n securetoken.googleapis.com\n storage.googleapis.com\n sts.googleapis.com\n www.googleapis.com\n servicecontrol.googleapis.com\n logging.googleapis.com\n monitoring.googleapis.com\n opsconfigmonitoring.googleapis.com\n \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-nf\"\u003eGCP_LOCATION\u003c/span\u003e\u003c/var\u003e-gkemulticloud.googleapis.com\n\nReplace \u003cvar translate=\"no\"\u003eGCP_LOCATION\u003c/var\u003e with the Google Cloud region in\nwhich your cluster resides. Specify `us-west1` or another\n[supported region](/kubernetes-engine/multi-cloud/docs/azure/reference/supported-regions).\n\nSubnet Network Security Group requirement\n\nIf you're using Network Security Groups (NSGs) to manage traffic to your subnets,\nyour NSG rules must allow outgoing TCP traffic to following destinations:\n\n- AzureCloud: TCP, port 80 and 443\n\nSee [Azure service tags](https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview#available-service-tags)\nfor more information about using service tags with NSGs.\n\n\nCreate a proxy configuration file\n\nThe proxy configuration is stored in an Azure Key Vault secret as a JSON string.\nYou can pass this configuration to the `az` command-line tool as a\nfile. This section describes how to create that file.\n\nThe following table describes the contents of this file.\n\n| **Field** | **Description** | **Examples** | **Required** |\n|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------|--------------|\n| `httpProxy` | A proxy server URL. The value should include a hostname/IP address and optionally a port, username, and password. | `\"http://user:password@10.184.37.42:80\"` `\"10.184.37.42\"` | Yes |\n| `httpsProxy` | A proxy URL for encrypted, HTTPS traffic. The httpProxy URL will be used if httpsProxy has an empty value. | `\"http://10.101.16.31:80\"` | Yes |\n| `noProxy` | A comma-separated list of URLs to exclude from proxying. Each value can be an IP address, a CIDR range, a domain name, or the asterix character (\\*). Domains specified with a leading dot (for example, \\`.google.com\\`) indicate that a subdomain is required. A single asterix \\* ignores all proxy configuration. | `\"1.2.3.4,10.0.0.0/16,example.com,.site.com\"` | Yes |\n\n1. To create the configuration file, create a JSON file that contains values for\n `httpProxy`, `noProxy`, and optional `httpsProxy` keys.\n\n ```json\n {\n \"httpProxy\": \"AUTHENTICATION_URL\",\n \"httpsProxy\": \"AUTHENTICATION_URL\",\n \"noProxy\": \"NO_PROXY_ADDRESSES\"\n }\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eAUTHENTICATION_URL\u003c/var\u003e: Encoded URL containing the proxy username and the password\n - \u003cvar translate=\"no\"\u003eNO_PROXY_ADDRESSES\u003c/var\u003e: Comma-separated list of CIDR blocks and URLs--- for example `10.0.0.0/16,http://example.com`\n\n Save the file to use in the following section.\n2. Create a secret with this JSON data as a secret in Azure Key Vault using\n the `az` command-line tool.\n\n az keyvault secret set --name \u003cvar translate=\"no\"\u003eSECRET_NAME\u003c/var\u003e \\\n --vault-name \u003cvar translate=\"no\"\u003eKEY_VAULT_NAME\u003c/var\u003e \\\n --file \u003cvar translate=\"no\"\u003ePROXY_CONFIGURATION_FILE\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eSECRET_NAME\u003c/var\u003e: the name of the new secret\n - \u003cvar translate=\"no\"\u003eKEY_VAULT_NAME\u003c/var\u003e: the name of your Key Vault\n - \u003cvar translate=\"no\"\u003ePROXY_CONFIGURATION_FILE\u003c/var\u003e: the path to your\n proxy configuration file.\n\n The output includes the secret's name and contents. You can now\n reference this secret when you create a cluster.\n\nCreate a cluster that uses a proxy\n\nTo configure GKE on Azure to use an HTTP proxy for outbound\nconnectivity, perform the following steps:\n\nFollow the steps in\n[Create a cluster and node pool](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-cluster)\nand pass the `--proxy-resource-group-id` and `--proxy-secret-id` flags. \n\n gcloud container azure clusters create \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --proxy-resource-group-id=\u003cvar translate=\"no\"\u003ePROXY_RESOURCE_GROUP_ID\u003c/var\u003e \\\n --proxy-secret-id=\u003cvar translate=\"no\"\u003ePROXY_SECRET_ID\u003c/var\u003e\n ...\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: your cluster's name\n- \u003cvar translate=\"no\"\u003ePROXY_RESOURCE_GROUP_ID\u003c/var\u003e: the resource group that hosts your cluster\n- \u003cvar translate=\"no\"\u003ePROXY_SECRET_ID\u003c/var\u003e: the ID of the secret that contains your proxy configuration--- for example, `https://`\u003cvar translate=\"no\"\u003eVAULT_NAME\u003c/var\u003e`.vault.azure.net/secrets/`\u003cvar translate=\"no\"\u003eSECRET_NAME\u003c/var\u003e`/`\u003cvar translate=\"no\"\u003eSECRET_VERSION\u003c/var\u003e\n\nWhat's next\n\n- Read additional information on how to [Create a cluster](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-cluster)."]]
