Azure용 GKE는 각 가상 머신(VM) 인스턴스의 가상 네트워크 인터페이스 카드(NIC)에 연결된 NSG를 관리합니다. 네트워크 트래픽을 더 세부적으로 제어하려면 서브넷에 NSG를 추가합니다.
Azure용 GKE는 필요한 NSG 규칙을 자동으로 관리하며, 누락된 NSG 규칙을 추가하고 더 이상 필요하지 않은 규칙을 삭제합니다. 또한 Azure용 GKE는 Kubernetes 서비스 구성에 따라 규칙을 수정합니다. 예를 들어 LoadBalancer 유형의 Kubernetes 서비스를 추가하면 Azure용 GKE가 해당 NSG 규칙을 추가합니다.
규칙 우선순위
Azure NSG 규칙 우선순위의 범위는 100~4096입니다. 숫자가 작을수록 우선순위가 높아집니다.
기본적으로 Azure용 GKE는 우선순위가 500 이상인 NSG 규칙만 관리합니다. 따라서 특정 규칙을 구현하거나 추가 규칙을 만들어야 하는 경우 우선순위가 100~499인 NSG를 사용할 수 있습니다.
Azure는 가장 낮은 우선순위부터 순서대로 규칙을 처리합니다. 새 규칙을 만들 때는 항상 기존 Anthos NSG 규칙과 충돌하지 않도록 100~499 범위의 규칙 우선순위를 선택합니다.
애플리케이션 보안 그룹
Azure용 GKE는 제어 영역 및 워커 노드의 가상 NIC에 적용되는 두 개의 애플리케이션 보안 그룹(ASG)을 만듭니다.
클러스터에 새 노드 풀을 추가할 때 Azure용 GKE는 ASG를 자동으로 업데이트합니다. NSG 규칙을 만들 때 이러한 ASG를 사용할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-06-27(UTC)"],[],[],null,["# Network security groups\n=======================\n\nThis page describes and lists the\n[Azure network security groups (NSGs)](https://docs.microsoft.com/azure/virtual-network/network-security-groups-overview)\nrequired by GKE on Azure.\n\nThis page is for Networking specialists who want to install, configure, and\nsupport network equipment. To learn more about common roles and example tasks\nthat we reference in Google Cloud content, see\n[Common GKE user roles and tasks](/kubernetes-engine/enterprise/docs/concepts/roles-tasks).\n\nManaged NSGs\n------------\n\nGKE on Azure manages the NSGs attached to the virtual network\ninterface card (NIC) of each virtual machine (VM) instance. To further control\nnetwork traffic, you can add additional NSGs to your subnets.\n\nGKE on Azure manages required NSG rules automatically. It adds missing\nNSG rules and removes rules that are no longer necessary. GKE on Azure\nalso modifies rules based on your Kubernetes Service configuration. For example,\nwhen you add a Kubernetes Service of type `LoadBalancer`, GKE on Azure\nadds the corresponding NSG rules.\n\nRule priorities\n---------------\n\nAzure NSG rule priorities have a range between 100 and 4096. The lower the\npriority number, the higher the priority.\n\nBy design, GKE on Azure manages only NSG rules with a priority of 500\nor higher. Therefore, if you need to implement a specific rule or create\nadditional rules, you can use NSGs with a priority between 100 and 499.\n\nAzure processes rules in order, starting with the lowest priority number and\nproceeding upward. When you create a new rule, always choose rule priorities in\nthe 100 to 499 range to avoid conflict with existing Anthos NSG rules.\n\nApplication security groups\n---------------------------\n\nGKE on Azure creates two\n[application security groups (ASGs)](https://docs.microsoft.com/azure/virtual-network/application-security-groups)\nthat apply to the virtual NICs of control planes and worker nodes.\nGKE on Azure updates ASGs automatically---for\nexample, when you add a new node pool to a cluster. You can use these ASGs\nwhen creating NSG rules.\n\nThe Azure Resource Manager (ARM) IDs of the NSG and control plane ASG\ncan be obtained from the output of\n[`gcloud container azure clusters describe`](/sdk/gcloud/reference/container/azure/clusters/describe).\n\nFor example, to allow SSH connections to the control plane VMs, run the\n`az network nsg rule create` command to create an NSG that references\nthe control plane ASG: \n\n NSG_NAME=$(basename $(gcloud container azure clusters describe \\\n \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n --format 'value(managedResources.networkSecurityGroupId)'))\n\n ASG_CP_NAME=$(basename $(gcloud container azure clusters describe \\\n \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n --format 'value(managedResources.controlPlaneApplicationSecurityGroupId)'))\n\n az network nsg rule create \\\n --name AllowSshToControlPlane \\\n --nsg-name \"${NSG_NAME}\" \\\n --priority 100 \\\n --resource-group \"\u003cvar translate=\"no\"\u003eCLUSTER_RESOURCE_GROUP\u003c/var\u003e\" \\\n --access Allow \\\n --protocol Tcp \\\n --destination-port-ranges 22 \\\n --destination-asgs \"${ASG_CP_NAME}\"\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of your cluster\n- \u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e: the Google Cloud location that manages your cluster\n- \u003cvar translate=\"no\"\u003eCLUSTER_RESOURCE_GROUP\u003c/var\u003e: the name of the Azure resource group that holds your cluster\n\nFor more information about creating a new rule, follow the procedure described in\n[Azure NSG rule creation](https://docs.microsoft.com/cli/azure/network/nsg/rule?view=azure-cli-latest#az_network_nsg_rule_create).\n\nDefault NSG rules\n-----------------\n\nWhen you set up GKE on Azure, it creates the following NSG rules in\nyour Azure virtual network."]]
