[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# GKE node connectivity insights\n\nThis page describes the Network Analyzer insights for Google Kubernetes Engine (GKE)\nnode connectivity. For information about all the insight types, see\n[Insight groups and types](/network-intelligence-center/docs/network-analyzer/insight-groups-types).\n\nNetwork Analyzer detects connectivity issues caused by configurations when\na GKE node initiates a connection to the GKE\ncontrol plane.\n\nView insights in the Recommender API\n------------------------------------\n\nTo view these insights in the Google Cloud CLI or the Recommender API, use\nthe following insight type:\n\n- `google.networkanalyzer.container.connectivityInsight`\n\nYou need the following permissions:\n\n- `recommender.networkAnalyzerGkeConnectivityInsights.list`\n- `recommender.networkAnalyzerGkeConnectivityInsights.get`\n\nFor more information about using the Recommender API for\nNetwork Analyzer insights, see [Use the Recommender CLI and API](/network-intelligence-center/docs/network-analyzer/use-cli-recommender-api).\n\nGKE node to control plane connectivity blocked by routing issue\n---------------------------------------------------------------\n\nThis insight indicates that the connections from the GKE nodes to\nthe control plane endpoint are blocked by a routing issue.\n\nIn private clusters, the control plane's VPC network is connected\nto your cluster's VPC network with [VPC Network\nPeering](/vpc/docs/vpc-peering). Traffic is routed to\nthe control plane using a\n[peering subnet route](/vpc/docs/routes#peering-subnet-routes)\nimported by the VPC Network Peering configuration.\nIn public clusters, traffic is routed to the control plane through the control\nplane endpoint IP using a route to the default internet gateway.\n\nThis insight includes the following information:\n\n- **GKE cluster:** The name of the GKE cluster.\n- **Control plane endpoint:** The IP address of the endpoint.\n- **Network:** The name of the network where the GKE cluster is configured.\n\n### Related topics\n\nFor more information, see\n[Control plane in private clusters](/kubernetes-engine/docs/concepts/private-cluster-concept#the_control_plane_in_private_clusters).\n\n### Recommendations\n\nGo to the GKE cluster details and verify VPC\npeering. If VPC peering is deleted, create the GKE\ncluster again.\n\nGKE node to control plane connectivity: public endpoint blocked by egress firewall\n----------------------------------------------------------------------------------\n\nThis insight indicates that the connectivity from GKE nodes to\nthe public endpoint is blocked by an egress firewall.\n\nGKE nodes in a public cluster communicate with the control plane\nthrough TCP on port 443. This connection is allowed by default by the\n[implied firewall rules](/vpc/docs/firewalls#default_firewall_rules)\nin your Google Cloud project. The firewall rule that is blocking the connection\nis listed in the insight details.\n\n### Related topics\n\nFor more information, see [Using firewall\nrules](/vpc/docs/using-firewalls).\n\n### Recommendations\n\nCreate an egress firewall rule that allows TCP traffic on port 443\nwith a destination filter of the cluster's endpoint. This rule should have a\nhigher priority than the blocking firewall rule.\n\nFor increased security this rule can be configured with the network tag of your\nGKE cluster nodes.\n\nGKE node to control plane connectivity: private endpoint blocked by egress firewall\n-----------------------------------------------------------------------------------\n\nThis insight indicates that the connectivity from GKE nodes to\nthe private endpoint is blocked by an egress firewall.\n\nGKE nodes in a public cluster communicate with the control plane\nthrough TCP on port 443. This connection is allowed by default by the\n[implied firewall rules](/vpc/docs/firewalls#default_firewall_rules)\nin your Google Cloud project. The firewall rule that is blocking the connection\nis listed in the insight details.\n\n### Related topics\n\nFor more information, see\n[Using firewall rules](/vpc/docs/using-firewalls).\n\n### Recommendations\n\nCreate an egress firewall rule that allows TCP traffic on port 443\nwith a destination filter of the cluster's control plane address range. This\nrule should have a higher priority than the blocking firewall rule.\n\nFor increased security this rule can be configured with the network tag of your\nGKE cluster nodes."]]
