비공개 GKE 클러스터는 Google API 및 서비스 연결에 대한 라우팅 요구사항을 충족하지 않는 VPC 네트워크를 사용합니다. VPC 네트워크가 라우팅 요구사항을 충족하지 않는 경우 네트워크 분석기가 통계를 생성합니다. 하지만 네트워크 분석기는 대상 IP 주소 범위가 DNS 구성에서 선택한 도메인 이름과 일치하는지 검증하지 않습니다. 이 라우팅 요구사항에 대한 자세한 내용은 비공개 Google 액세스 구성의 라우팅 옵션을 참조하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# GKE best practices insights\n\nThis page describes the Network Analyzer insights for Google Kubernetes Engine (GKE)\nbest practices. For information about all the insight types, see\n[Insight groups and types](/network-intelligence-center/docs/network-analyzer/insight-groups-types).\n\nGKE best practices insights validate that best\npractices are being followed for GKE cluster\nconfigurations. An insight from this category suggests areas of improvement\nand does not indicate active failures. Network Analyzer validates the\nfollowing conditions:\n\n- The control plane is able to receive traffic from all IP addresses in the node subnet.\n- Private Google Access is enabled for the private clusters.\n\nView insights in the Recommender API\n------------------------------------\n\nTo view these insights in the Google Cloud CLI or the Recommender API, use\nthe following insight type:\n\n- `google.networkanalyzer.container.connectivityInsight`\n\nYou need the following permissions:\n\n- `recommender.networkAnalyzerGkeConnectivityInsights.list`\n- `recommender.networkAnalyzerGkeConnectivityInsights.get`\n\nFor more information about using the Recommender API for\nNetwork Analyzer insights, see [Use the Recommender CLI and API](/network-intelligence-center/docs/network-analyzer/use-cli-recommender-api).\n\nGKE cluster needs extended authorized range\n-------------------------------------------\n\nThe subnet used by a GKE cluster has been expanded with\nauthorized networks enabled. However, the cluster's authorized network hasn't\nbeen updated to include the expanded IP address range. The nodes created in the\nextended subnet range won't be able to communicate with the GKE\ncontrol plane.\n\nThis insight includes the following information:\n\n- **GKE cluster:** The name of the GKE cluster.\n- **Network:** The name of the network where the GKE cluster is configured.\n- **Subnet:** The name of the subnetwork where the GKE cluster is configured.\n- **Subnet range:** The primary IP range of the cluster's primary subnet.\n\n### Related topics\n\nFor more information, see\n[Authorized network limitations](/kubernetes-engine/docs/how-to/authorized-networks#limitations).\n\n### Recommendations\n\nAdd the cluster's primary subnet range as an authorized network range. For more\ninformation, see [Add an authorized network to an existing cluster](/kubernetes-engine/docs/how-to/authorized-networks#add).\n\nPrivate Google Access disabled on GKE private cluster\n-----------------------------------------------------\n\nYour private GKE cluster is on a subnet that has Private Google\nAccess disabled. Private Google Access provides private nodes and their\nworkloads access to Google Cloud APIs and services over Google's private network.\n\nThis insight includes the following information:\n\n- **GKE cluster:** The name of the GKE cluster.\n- **Network:** The name of the network where the GKE cluster is configured.\n- **Subnet:** The name of the subnetwork where the GKE cluster is configured.\n\n### Related topics\n\nFor more information, see\n[Using Private Google Access in private clusters](/kubernetes-engine/docs/concepts/private-cluster-concept#using_in_private_clusters).\n\n### Recommendations\n\n[Enable Private Google Access](/vpc/docs/configure-private-google-access#enabling-pga)\non the cluster's primary subnet.\n\nGKE private cluster without routes to Google APIs and services\n--------------------------------------------------------------\n\nYour private GKE cluster uses a VPC network that\ndoes not meet the routing requirement for connectivity to Google APIs and\nservices. Network Analyzer generates an insight if your VPC\nnetwork does not meet the routing requirement. But, Network Analyzer doesn't\nvalidate that the destination IP address ranges match the domain names you have\nchosen in your DNS configuration. For details about this routing requirement,\nsee [Routing options](/vpc/docs/configure-private-google-access#config-routing) in\nConfiguring Private Google Access."]]
