您的私人 GKE 叢集使用虛擬私有雲網路，但該網路不符合 Google API 和服務的路由規定。如果 VPC 網路不符合轉送要求，網路分析器就會產生洞察資料。不過，Network Analyzer 不會驗證目的地 IP 位址範圍是否與您在 DNS 設定中選擇的網域名稱相符。如要進一步瞭解這項轉送需求，請參閱「設定私人 Google 存取權」中的「轉送選項」。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# GKE best practices insights\n\nThis page describes the Network Analyzer insights for Google Kubernetes Engine (GKE)\nbest practices. For information about all the insight types, see\n[Insight groups and types](/network-intelligence-center/docs/network-analyzer/insight-groups-types).\n\nGKE best practices insights validate that best\npractices are being followed for GKE cluster\nconfigurations. An insight from this category suggests areas of improvement\nand does not indicate active failures. Network Analyzer validates the\nfollowing conditions:\n\n- The control plane is able to receive traffic from all IP addresses in the node subnet.\n- Private Google Access is enabled for the private clusters.\n\nView insights in the Recommender API\n------------------------------------\n\nTo view these insights in the Google Cloud CLI or the Recommender API, use\nthe following insight type:\n\n- `google.networkanalyzer.container.connectivityInsight`\n\nYou need the following permissions:\n\n- `recommender.networkAnalyzerGkeConnectivityInsights.list`\n- `recommender.networkAnalyzerGkeConnectivityInsights.get`\n\nFor more information about using the Recommender API for\nNetwork Analyzer insights, see [Use the Recommender CLI and API](/network-intelligence-center/docs/network-analyzer/use-cli-recommender-api).\n\nGKE cluster needs extended authorized range\n-------------------------------------------\n\nThe subnet used by a GKE cluster has been expanded with\nauthorized networks enabled. However, the cluster's authorized network hasn't\nbeen updated to include the expanded IP address range. The nodes created in the\nextended subnet range won't be able to communicate with the GKE\ncontrol plane.\n\nThis insight includes the following information:\n\n- **GKE cluster:** The name of the GKE cluster.\n- **Network:** The name of the network where the GKE cluster is configured.\n- **Subnet:** The name of the subnetwork where the GKE cluster is configured.\n- **Subnet range:** The primary IP range of the cluster's primary subnet.\n\n### Related topics\n\nFor more information, see\n[Authorized network limitations](/kubernetes-engine/docs/how-to/authorized-networks#limitations).\n\n### Recommendations\n\nAdd the cluster's primary subnet range as an authorized network range. For more\ninformation, see [Add an authorized network to an existing cluster](/kubernetes-engine/docs/how-to/authorized-networks#add).\n\nPrivate Google Access disabled on GKE private cluster\n-----------------------------------------------------\n\nYour private GKE cluster is on a subnet that has Private Google\nAccess disabled. Private Google Access provides private nodes and their\nworkloads access to Google Cloud APIs and services over Google's private network.\n\nThis insight includes the following information:\n\n- **GKE cluster:** The name of the GKE cluster.\n- **Network:** The name of the network where the GKE cluster is configured.\n- **Subnet:** The name of the subnetwork where the GKE cluster is configured.\n\n### Related topics\n\nFor more information, see\n[Using Private Google Access in private clusters](/kubernetes-engine/docs/concepts/private-cluster-concept#using_in_private_clusters).\n\n### Recommendations\n\n[Enable Private Google Access](/vpc/docs/configure-private-google-access#enabling-pga)\non the cluster's primary subnet.\n\nGKE private cluster without routes to Google APIs and services\n--------------------------------------------------------------\n\nYour private GKE cluster uses a VPC network that\ndoes not meet the routing requirement for connectivity to Google APIs and\nservices. Network Analyzer generates an insight if your VPC\nnetwork does not meet the routing requirement. But, Network Analyzer doesn't\nvalidate that the destination IP address ranges match the domain names you have\nchosen in your DNS configuration. For details about this routing requirement,\nsee [Routing options](/vpc/docs/configure-private-google-access#config-routing) in\nConfiguring Private Google Access."]]
