Restez organisé à l'aide des collections
Enregistrez et classez les contenus selon vos préférences.
Configurer les services TCP
Ce guide vous explique comment configurer Cloud Service Mesh pour utiliser les services TCP et les ressources TCPRoute.
Cloud Service Mesh avec des services TCP et TCPRoute est semblable à la configuration de proxy side-car Envoy avec des services HTTP. Les exceptions sont que le service de backend fournit un service TCP et le routage est basé sur les paramètres TCP/IP plutôt que sur le protocole HTTP.
ressource Mesh avec Ressource TCPRoute (cliquez pour agrandir)
Cette partie du guide n'est pas spécifique aux nouvelles API et utilise les ressources de service de backend, de vérification d'état et de MIG existantes.
À des fins de démonstration, vous créez un service de backend avec des VM avec autoscaling à l'aide de groupes d'instances gérés qui diffusent un service TCP de test sur le port 10000.
Créez un modèle d'instance de VM Compute Engine avec un service de test sur le port 10000.
Créez un service de backend global avec un schéma d'équilibrage de charge de INTERNAL_SELF_MANAGED et associez la vérification d'état au service de backend. L'exemple utilise le groupe d'instances géré qui exécute l'exemple de service TCP que vous avez créé précédemment.
Vérifiez la connectivité aux services de test que vous avez créés à l'aide de l'utilitaire netcat.
echo 'Hi TCP Service' | nc 10.0.0.1 10000
Le service de test doit renvoyer l'expression Hello from TCP service. Vous devriez également voir tout texte saisi renvoyé par le service netcat qui s'exécute sur la VM distante.
Limites
Vous ne pouvez pas configurer de stratégie de sécurité Google Cloud Armor si vous utilisez le routage du trafic TCP.
Sauf indication contraire, le contenu de cette page est régi par une licence Creative Commons Attribution 4.0, et les échantillons de code sont régis par une licence Apache 2.0. Pour en savoir plus, consultez les Règles du site Google Developers. Java est une marque déposée d'Oracle et/ou de ses sociétés affiliées.
Dernière mise à jour le 2025/09/04 (UTC).
[[["Facile à comprendre","easyToUnderstand","thumb-up"],["J'ai pu résoudre mon problème","solvedMyProblem","thumb-up"],["Autre","otherUp","thumb-up"]],[["Difficile à comprendre","hardToUnderstand","thumb-down"],["Informations ou exemple de code incorrects","incorrectInformationOrSampleCode","thumb-down"],["Il n'y a pas l'information/les exemples dont j'ai besoin","missingTheInformationSamplesINeed","thumb-down"],["Problème de traduction","translationIssue","thumb-down"],["Autre","otherDown","thumb-down"]],["Dernière mise à jour le 2025/09/04 (UTC)."],[],[],null,["# Set up TCP services\n===================\n\n| **Note:** This guide only supports Cloud Service Mesh with Google Cloud APIs and does not support Istio APIs. For more information see, [Cloud Service Mesh overview](/service-mesh/docs/overview).\n\nThis guide tells you how to set up Cloud Service Mesh to use TCP services\nand `TCPRoute` resources.\n\nCloud Service Mesh with TCP services and `TCPRoute` is similar to the\nEnvoy sidecar proxy configuration with HTTP services. The exceptions are that\nthe backend service provides a TCP service and routing is based on TCP/IP\nparameters rather than on the HTTP protocol.\n[](/static/service-mesh/docs/images/mesh-tcp.svg) `Mesh` resource with `TCPRoute` resource (click to enlarge)\n\nBefore you begin\n----------------\n\nMake sure that you complete the tasks described in\n[Prepare to set up with Envoy and proxyless workloads](/service-mesh/docs/onboarding/prepare-service-routing-envoy-proxyless).\n\nConfigure the `Mesh` resource\n-----------------------------\n\n1. In a file called `mesh.yaml`, create the `mesh` resource specification.\n\n ```\n name: sidecar-mesh\n ```\n2. Use the `mesh.yaml` file to create the `mesh` resource.\n\n ```\n gcloud network-services meshes import sidecar-mesh \\\n --source=mesh.yaml \\\n --location=global\n ```\n\nConfigure the TCP server\n------------------------\n\nThis part of the guide is not specific to the new APIs and uses existing\nbackend service, health check, and MIG resources.\n\nFor demonstration purposes, you create a backend service with autoscaled VMs\nusing [managed instance groups](/compute/docs/instance-groups#managed_instance_groups)\nthat serve a test TCP service on port `10000`.\n\n1. Create a Compute Engine VM instance template with a test\n service on port `10000`.\n\n ```\n gcloud compute instance-templates create tcp-td-vm-template \\\n --scopes=https://www.googleapis.com/auth/cloud-platform \\\n --tags=allow-health-checks \\\n --image-family=debian-10 \\\n --image-project=debian-cloud \\\n --metadata=startup-script=\"#! /bin/bash\n sudo apt-get update -y\n sudo apt-get install netcat -y\n while true;\n do echo 'Hello from TCP service' | nc -l -s 0.0.0.0 -p 10000;\n done &\"\n ```\n2. Create a managed instance group based on the template.\n\n ```\n gcloud compute instance-groups managed create tcp-td-mig-us-east1 \\\n --zone=ZONE \\\n --size=1 \\\n --template=tcp-td-vm-template\n ```\n3. Set the named ports on the created managed instance group to port 10000.\n\n ```\n gcloud compute instance-groups set-named-ports tcp-td-mig-us-east1 \n\n --zone=ZONE \n\n --named-ports=tcp:10000\n ```\n\n \u003cbr /\u003e\n\n4. Create a health check.\n\n ```\n gcloud compute health-checks create tcp tcp-helloworld-health-check --port 10000\n ```\n5. Create a firewall rule to allow incoming health check connections to\n instances in your network.\n\n ```\n gcloud compute firewall-rules create tcp-vm-allow-health-checks \\\n --network default \\\n --action allow \\\n --direction INGRESS \\\n --source-ranges=35.191.0.0/16,130.211.0.0/22 \\\n --target-tags allow-health-checks \\\n --rules tcp:10000\n ```\n6. Create a [global backend service](/load-balancing/docs/backend-service)\n with a load balancing scheme of `INTERNAL_SELF_MANAGED` and attach the\n health check to the backend service. The example uses the managed instance\n group that runs the sample TCP service that you created earlier.\n\n ```\n gcloud compute backend-services create tcp-helloworld-service \\\n --global \\\n --load-balancing-scheme=INTERNAL_SELF_MANAGED \\\n --protocol=TCP \\\n --health-checks tcp-helloworld-health-check\n ```\n7. Add the managed instance group to the backend service.\n\n ```\n gcloud compute backend-services add-backend tcp-helloworld-service \\\n --instance-group tcp-td-mig-us-east1 \\\n --instance-group-zone=ZONE \\\n --global\n ```\n\nSet up routing with `TCPRoute`\n------------------------------\n\nIn this section, you set up routing.\n\n1. In a file called `tcp_route.yaml`, create the `TcpRoute` specification.\n\n You can use either `$PROJECT_ID` or `$PROJECT_NUMBER`. \n\n ```\n name: helloworld-tcp-route\n meshes:\n - projects/$PROJECT_NUMBER/locations/global/meshes/sidecar-mesh\n rules:\n - action:\n destinations:\n - serviceName: projects/$PROJECT_NUMBER/locations/global/backendServices/tcp-helloworld-service\n matches:\n - address: '10.0.0.1/32'\n port: '10000'\n ```\n2. Using the `tcp_route.yaml` specification, create the `TcpRoute` resource.\n\n ```\n gcloud network-services tcp-routes import helloworld-tcp-route \\\n --source=tcp-route.yaml \\\n --location=global\n ```\n\nCreate a TCP client with an Envoy sidecar\n-----------------------------------------\n\n1. Create an instance template and then create a VM with Envoy that is\n connected to Cloud Service Mesh.\n\n ```\n gcloud beta compute instance-templates create td-vm-client-template \\\n --image-family=debian-10 \\\n --image-project=debian-cloud \\\n --service-proxy=enabled,mesh=sidecar-mesh \\\n --metadata=startup-script=\"#! /bin/bash\n sudo apt-get update -y\n sudo apt-get install netcat -y\"\n ``` \n\n ```\n gcloud compute instances create td-vm-client \\\n --zone=ZONE \\\n --source-instance-template td-vm-client-template\n ```\n2. Sign in to the VM that you created.\n\n ```\n gcloud compute ssh td-vm-client\n ```\n3. Verify connectivity to the test services that you created using the `netcat`\n utility.\n\n ```\n echo 'Hi TCP Service' | nc 10.0.0.1 10000\n ```\n\nThe test service should return the phrase **Hello from TCP\nservice** . You should also be able to see any text that you type\nreturned by the `netcat` service running on the remote VM.\n\nLimitations\n-----------\n\nYou cannot configure a Google Cloud Armor security policy if you are using\nTCP traffic routing.\n\nWhat's next\n-----------\n\n- [List `Route` resources](/service-mesh/docs/service-routing/list-route-resources)"]]
