이 통계는 GKE 제어 영역에서 노드로의 연결이 라우팅 문제로 인해 차단되었음을 나타냅니다. 이 통계에는 다음 정보가 포함됩니다.
GKE 클러스터: GKE 클러스터의 이름입니다.
컨트롤 플레인 엔드포인트: 엔드포인트의 IP 주소입니다.
네트워크: GKE 클러스터가 구성된 네트워크의 이름입니다.
비공개 클러스터에서 제어 영역의 VPC 네트워크는 VPC 네트워크 피어링을 통해 클러스터의 VPC 네트워크에 연결됩니다. 트래픽은 VPC 네트워크 피어링 구성으로 가져온 피어링 서브넷 경로를 사용하여 제어 영역으로 라우팅됩니다. 이 통계는 공개 클러스터에 나타나서는 안 됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# GKE control plane connectivity insights\n\nThis page describes the Network Analyzer insights for\nGoogle Kubernetes Engine (GKE) control plane connectivity. For information about\nall the insight types, see\n[Insight groups and types](/network-intelligence-center/docs/network-analyzer/insight-groups-types).\n\nNetwork Analyzer detects connectivity issues caused by configurations when\nthe GKE control plane initiates a connection with a\nGKE node.\n\nView insights in the Recommender API\n------------------------------------\n\nTo view these insights in the Google Cloud CLI or the Recommender API, use\nthe following insight type:\n\n- `google.networkanalyzer.container.connectivityInsight`\n\nYou need the following permissions:\n\n- `recommender.networkAnalyzerGkeConnectivityInsights.list`\n- `recommender.networkAnalyzerGkeConnectivityInsights.get`\n\nFor more information about using the Recommender API for\nNetwork Analyzer insights, see [Use the Recommender CLI and API](/network-intelligence-center/docs/network-analyzer/use-cli-recommender-api).\n\nGKE control plane to node connectivity blocked by routing issue\n---------------------------------------------------------------\n\nThis insight indicates that the connection from the GKE control\nplane to the node is blocked by a routing issue. This insight includes the\nfollowing information:\n\n- **GKE cluster:** The name of the GKE cluster.\n- **Control plane endpoint:** The IP address of the endpoint.\n- **Network:** The name of the network where the GKE cluster is configured.\n\nIn private clusters, the control plane's VPC network is connected\nto your cluster's VPC network with\n[VPC Network Peering](/vpc/docs/vpc-peering). Traffic is routed to the control plane by using a\n[peering subnet route](/vpc/docs/routes#peering-subnet-routes)\nimported by the VPC Network Peering configuration. This insight\nshouldn't occur in public clusters.\n\n### Related topics\n\nFor more information, see\n[Control plane in private clusters](/kubernetes-engine/docs/concepts/private-cluster-concept#the_control_plane_in_private_clusters).\n\n### Recommendations\n\nGo to the GKE cluster details and verify VPC Network Peering.\nIf VPC Network Peering is deleted, create the GKE cluster again.\n\nGKE control plane to node connectivity blocked by ingress firewall on the node\n------------------------------------------------------------------------------\n\nThis insight indicates that the connection from the GKE control\nplane to the node is blocked by an ingress firewall on the node. This insight\nincludes the following information:\n\n- **GKE cluster:** The name of the GKE cluster.\n- **Control plane endpoint:** The IP address of the GKE control plane.\n- **Network:** The name of the network where the GKE cluster is configured.\n- **Blocking ingress firewall:** If the connectivity from the control plane to the node is blocked by an ingress firewall, it shows the name of this firewall; otherwise, this field is not displayed.\n- **Ports:** The ports on the GKE nodes that have the traffic blocked. For public clusters, the control plane communicates with GKE nodes on port 22. For private clusters, the control plane communicates with the GKE nodes on port 443 and port 10250.\n\nBy default, GKE creates\n[firewall rules](/kubernetes-engine/docs/concepts/firewall-rules#cluster-fws)\nto allow communication between the control plane and the GKE\nnodes in your project. This insight indicates that either these default firewall\nrules have been modified or removed, or that another firewall rule in your\nVPC network is shadowing the automatically created firewall rules.\n\n### Related topics\n\nFor more information, see\n[Automatically created firewall rules](/kubernetes-engine/docs/concepts/firewall-rules#cluster-fws)\nand [Firewall rules overview](/vpc/docs/firewalls).\n\n### Recommendations\n\n- If the automatically created firewall rule is deleted from your VPC network, re-create it.\n- If the automatically created firewall rule exists, then the blocking firewall rule has higher priority. Increase the priority on the automatically created firewall rule."]]
