您的专用 GKE 集群使用的 VPC 网络不满足连接 Google API 和服务的要求。如果您的 VPC 网络不满足路由要求，网络分析器会生成数据分析。但是，网络分析器不会验证目标 IP 地址范围与您在 DNS 配置中选择的域名相匹配。如需详细了解此路由要求，请参阅配置专用 Google 访问通道中的路由选项。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# GKE best practices insights\n\nThis page describes the Network Analyzer insights for Google Kubernetes Engine (GKE)\nbest practices. For information about all the insight types, see\n[Insight groups and types](/network-intelligence-center/docs/network-analyzer/insight-groups-types).\n\nGKE best practices insights validate that best\npractices are being followed for GKE cluster\nconfigurations. An insight from this category suggests areas of improvement\nand does not indicate active failures. Network Analyzer validates the\nfollowing conditions:\n\n- The control plane is able to receive traffic from all IP addresses in the node subnet.\n- Private Google Access is enabled for the private clusters.\n\nView insights in the Recommender API\n------------------------------------\n\nTo view these insights in the Google Cloud CLI or the Recommender API, use\nthe following insight type:\n\n- `google.networkanalyzer.container.connectivityInsight`\n\nYou need the following permissions:\n\n- `recommender.networkAnalyzerGkeConnectivityInsights.list`\n- `recommender.networkAnalyzerGkeConnectivityInsights.get`\n\nFor more information about using the Recommender API for\nNetwork Analyzer insights, see [Use the Recommender CLI and API](/network-intelligence-center/docs/network-analyzer/use-cli-recommender-api).\n\nGKE cluster needs extended authorized range\n-------------------------------------------\n\nThe subnet used by a GKE cluster has been expanded with\nauthorized networks enabled. However, the cluster's authorized network hasn't\nbeen updated to include the expanded IP address range. The nodes created in the\nextended subnet range won't be able to communicate with the GKE\ncontrol plane.\n\nThis insight includes the following information:\n\n- **GKE cluster:** The name of the GKE cluster.\n- **Network:** The name of the network where the GKE cluster is configured.\n- **Subnet:** The name of the subnetwork where the GKE cluster is configured.\n- **Subnet range:** The primary IP range of the cluster's primary subnet.\n\n### Related topics\n\nFor more information, see\n[Authorized network limitations](/kubernetes-engine/docs/how-to/authorized-networks#limitations).\n\n### Recommendations\n\nAdd the cluster's primary subnet range as an authorized network range. For more\ninformation, see [Add an authorized network to an existing cluster](/kubernetes-engine/docs/how-to/authorized-networks#add).\n\nPrivate Google Access disabled on GKE private cluster\n-----------------------------------------------------\n\nYour private GKE cluster is on a subnet that has Private Google\nAccess disabled. Private Google Access provides private nodes and their\nworkloads access to Google Cloud APIs and services over Google's private network.\n\nThis insight includes the following information:\n\n- **GKE cluster:** The name of the GKE cluster.\n- **Network:** The name of the network where the GKE cluster is configured.\n- **Subnet:** The name of the subnetwork where the GKE cluster is configured.\n\n### Related topics\n\nFor more information, see\n[Using Private Google Access in private clusters](/kubernetes-engine/docs/concepts/private-cluster-concept#using_in_private_clusters).\n\n### Recommendations\n\n[Enable Private Google Access](/vpc/docs/configure-private-google-access#enabling-pga)\non the cluster's primary subnet.\n\nGKE private cluster without routes to Google APIs and services\n--------------------------------------------------------------\n\nYour private GKE cluster uses a VPC network that\ndoes not meet the routing requirement for connectivity to Google APIs and\nservices. Network Analyzer generates an insight if your VPC\nnetwork does not meet the routing requirement. But, Network Analyzer doesn't\nvalidate that the destination IP address ranges match the domain names you have\nchosen in your DNS configuration. For details about this routing requirement,\nsee [Routing options](/vpc/docs/configure-private-google-access#config-routing) in\nConfiguring Private Google Access."]]
