Cloud Service Mesh 클러스터에서 서비스 경계에 액세스할 수 있도록 특정 서비스를 서비스 경계의 허용 및 제한된 서비스 목록에 추가해야 합니다.
이러한 서비스에 대한 액세스는 클러스터의 Virtual Private Cloud(VPC) 네트워크 내에서도 제한됩니다.
이러한 서비스를 추가하지 않으면 Cloud Service Mesh 설치가 실패하거나 올바르게 작동하지 않을 수 있습니다. 예를 들어 Mesh Configuration API를 서비스 경계에 추가하지 않으면 설치가 실패하고 워크로드는 관리형 제어 영역에서 Envoy 구성을 수신하지 않습니다.
이미지가 서비스 경계 외부에 있으면 이 오류가 발생할 수 있습니다.
이미지를 경계 내에 있는 버킷으로 이동하거나 경계를 업데이트하여 이그레스 규칙을 추가합니다. 일반적으로 이그레스 규칙은 선택한 ID에서 Container Registry API, Artifact Registry API, Cloud Storage API에 액세스하도록 허용할 수 있습니다.
ControlPlaneRevision CRD의 상태 필드에 VPC 서비스 제어 오류가 표시됨
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["VPC Service Controls for Cloud Service Mesh (Managed) **Note:** This guide only supports Cloud Service Mesh with Istio APIs and does not support Google Cloud APIs. For more information see, [Cloud Service Mesh overview](/service-mesh/docs/overview).\n\nCloud Service Mesh (Managed) supports [VPC Service Controls](/vpc-service-controls)\nas a generally available (GA) feature for new control planes.\n\nTo check whether your control plane supports VPC Service Controls GA, check the mesh feature\nstate of your membership for the VPCSC_GA_SUPPORTED condition. \n\n```bash\ngcloud container fleet mesh describe --project FLEET_PROJECT_ID\n```\n\nThe output is similar to: \n\n```bash\n(...)\nmembershipStates:\n projects/FLEET_PROJECT_NUMBER/locations/MEMBERSHIP_LOCATION/memberships/MEMBERSHIP_ID:\n servicemesh:\n conditions:\n - code: VPCSC_GA_SUPPORTED\n details: This control plane supports VPC Service Controls GA.\n documentationLink: http://cloud.google.com/service-mesh/docs/managed/VPC Service Controls\n severity: INFO\n(...)\n```\n\nIf you have an existing control plane that does not report the\nVPCSC_GA_SUPPORTED condition and want to rely on VPC Service Controls, contact support.\n\nBefore you begin\n\nThe VPC Service Controls org-policy and service perimeter are configured at the\n[organization level](/resource-manager/docs/cloud-platform-resource-hierarchy).\nEnsure that you have been granted the\n[proper roles for administering VPC Service Controls](/vpc-service-controls/docs/access-control).\n\nSet up your VPC Service Controls service perimeter\n\nCreate or update your [service perimeter](/vpc-service-controls/docs/service-perimeters):\n\n1. [Add your cluster project(s) and fleet project](/vpc-service-controls/docs/manage-service-perimeters#update) to the service perimeter. Having a service mesh spread across multiple VPC Service Controls\n perimeters is not supported.\n\n2. Add restricted services to the service perimeter.\n\n You must add specific services to the allowed and restricted services lists in\n the service perimeter, so that your Cloud Service Mesh cluster can access them.\n Access to these services is also restricted within your cluster's\n Virtual Private Cloud (VPC) network.\n\n Not adding these services may cause the Cloud Service Mesh installation to fail or to\n not function properly. For example, if you don't add the\n **Mesh Configuration API** to the service perimeter, the installation will fail\n and the workloads won't receive their Envoy configuration from the managed\n control plane. \n\n Console\n 1. Follow the steps in [Updating a service perimeter](/vpc-service-controls/docs/manage-service-perimeters#update) to edit the perimeter.\n 2. Click the **Edit VPC Service Perimeter** page.\n 3. Under **Restricted Services** , **Services to protect** , click **Add Services**.\n 4. On the **Specify services to restrict** dialog, click **Filter\n services** , and enter **Mesh Configuration API**.\n 5. Select the service's checkbox.\n 6. Click **Add Mesh Configuration API**.\n 7. Repeat steps c - f, to add:\n - **Cloud Service Mesh Certificate Authority API**\n - **GKE Hub API**\n - **Cloud IAM API**\n - **Cloud Monitoring API**\n - **Cloud Trace API**\n - **Cloud Monitoring API**\n - **Google Cloud Resource Manager API**\n - **Google Compute Engine API**\n - **Google Container Registry API**\n - **Artifact Registry API**\n - **Google Cloud Storage API**\n - **Cloud Logging API**\n - **Security Token Service API**\n 8. Click **Save**.\n\n gcloud\n\n To update the list of restricted services, use the `update` command and\n specify the services to add as a comma-delimited list: \n\n ```bash\n gcloud access-context-manager perimeters update PERIMETER_NAME \\\n --add-restricted-services=meshconfig.googleapis.com,meshca.googleapis.com,gkehub.googleapis.com,iam.googleapis.com,monitoring.googleapis.com,cloudtrace.googleapis.com,monitoring.googleapis.com,cloudresourcemanager.googleapis.com,compute.googleapis.com,containerregistry.googleapis.com,artifactregistry.googleapis.com,storage.googleapis.com,logging.googleapis.com,sts.googleapis.com \\\n --policy=POLICY_NAME\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e is the name of the service perimeter that you\n want to update.\n\n - \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the numeric name of your organization's access\n policy. For example, `330193482019`.\n\n3. Click on **VPC Accessible services** and set it to 'All restricted services', so that services restricted at the step above are still accessible from within the VPC Service Controls perimeter.\n\n4. Unless you are installing Cloud Service Mesh from an in-perimeter network, add an\n ingress rule to allow the identity running the `asmcli` command access to the\n service perimeter.\n\n For more information, see\n [Updating a service perimeter](/vpc-service-controls/docs/manage-service-perimeters#update).\n\nInstall the managed Cloud Service Mesh in a VPC Service Controls perimeter\n\nFollow the steps in\n[Configure managed Cloud Service Mesh](/service-mesh/docs/managed/provision-managed-anthos-service-mesh)\npage. Then,\n[verify the control plane has been successfully provisioned](/service-mesh/docs/managed/provision-managed-anthos-service-mesh#verify_the_control_plane_has_been_provisioned)\nand there are no VPC Service Controls related errors.\n\nTroubleshooting\n\nCannot create cluster with the latest GKE 1.22 image\n\nThere is a known issue preventing the creation of a cluster with the latest\n1.22 image in a VPC Service Controls restricted environment. The workaround is to create this\ncluster first with the default GKE channel image, and then upgrade the image: \n\n```bash\ngcloud container clusters create CLUSTER \\\n --region REGION \\\n --release-channel=rapid \\\n --workload-pool=PROJECT_ID.svc.id.goog \\\n --project PROJECT_ID\n``` \n\n```bash\ngcloud container clusters upgrade CLUSTER \\\n --region REGION \\\n --master --cluster-version 1.22 \\\n --project PROJECT_ID\n```\n\nContainers are not able to download their images.\n\nThis may happen if the images are located outside of the service perimeter.\nEither move the images to a bucket located inside the perimeter, or update the\nperimeter to add an Egress rule. Typically, the Egress rule may allow selected\nidentities to access the **Container Registry API** , **Artifact Registry API** ,\nand **Cloud Storage API**.\n\nThe Status field of the `ControlPlaneRevision` CRD displays VPC Service Controls errors\n\nRun this command to get more info about the error: \n\n```bash\ngcloud logging read --project=PROJECT_ID \\\n'protoPayload.metadata.@type=type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata'\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the project ID of the project encountering errors."]]
