조직에 서비스 경계를 만들었으면 다음과 같은 경우에 인증 기관(Cloud Service Mesh 인증 기관 또는 Certificate Authority Service), 메시 구성, Stackdriver Logging, Cloud Monitoring, Cloud Trace 서비스를 경계에 추가해야 합니다.
Cloud Service Mesh를 설치한 클러스터는 서비스 경계에 포함된 프로젝트에 있습니다.
Cloud Service Mesh를 설치한 클러스터는 공유 VPC 네트워크의 서비스 프로젝트입니다.
이러한 서비스를 서비스 경계에 추가하면 Cloud Service Mesh 클러스터에서 이러한 서비스에 액세스할 수 있습니다. 서비스에 대한 액세스는 클러스터의 가상 프라이빗 클라우드(VPC) 네트워크 내에서도 제한됩니다.
앞서 언급한 서비스를 추가하지 않으면 Cloud Service Mesh 설치가 실패하거나 기능이 누락될 수 있습니다. 예를 들어 Cloud Service Mesh 인증 기관을 서비스 경계에 추가하지 않으면 워크로드가 Cloud Service Mesh 인증 기관에서 인증서를 가져올 수 없습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["Adding Cloud Service Mesh (In-cluster) services to the\nservice perimeters **Note:** This guide only supports Cloud Service Mesh with Istio APIs and does not support Google Cloud APIs. For more information see, [Cloud Service Mesh overview](/service-mesh/docs/overview).\n\nIf you have created a\n[service perimeter](/vpc-service-controls/docs/service-perimeters) in your\norganization, you must add the\n[Certificate Authority](/service-mesh/docs/unified-install/plan-install#choose_a_certificate_authority)\n(Cloud Service Mesh certificate authority or Certificate Authority Service), Mesh Configuration,\nStackdriver logging, Cloud Monitoring, and Cloud Trace services to the\nperimeter, in the following cases:\n\n- The cluster on which you have installed Cloud Service Mesh is in a project that is included in a service perimeter.\n- The cluster on which you have installed Cloud Service Mesh is a *service project* in a [Shared VPC network](/vpc/docs/shared-vpc).\n\nBy adding these services to the service perimeter, your Cloud Service Mesh\ncluster can access these services. Access to the services is also restricted\nwithin your cluster's Virtual Private Cloud (VPC) network.\n\nNot adding the aforementioned services may cause the Cloud Service Mesh\ninstallation to fail or cause functions to be missing. For example, if you don't\nadd Cloud Service Mesh certificate authority to the service perimeter, the workloads can not get\ncertificates from the Cloud Service Mesh certificate authority.\n\nBefore you begin\n\nThe setup for the VPC Service Controls service perimeter is at the\n[organization level](/resource-manager/docs/cloud-platform-resource-hierarchy).\nEnsure that you have been granted the\n[proper roles for administering VPC Service Controls](/vpc-service-controls/docs/access-control).\nIf you have multiple projects, you can apply the service perimeter to all of\nthe projects by\n[adding each project to the service perimeter](/vpc-service-controls/docs/manage-service-perimeters#update).\n\nAdding Cloud Service Mesh services to an existing service perimeter \n\nConsole\n\n1. Follow the steps in [Updating a service perimeter](/vpc-service-controls/docs/manage-service-perimeters#update) to edit the perimeter.\n2. On the **Edit VPC Service Perimeter** page, under **Services to\n protect** , click **Add Services**.\n3. On the **Specify services to restrict** dialog, click **Filter\n services** . Depending on your Certificate Authority (CA), enter either **Cloud Service Mesh Certificate Authority API** or **Certificate Authority Service API**.\n4. Select the service's checkbox.\n5. Click **Add Cloud Service Mesh Certificate Authority API**.\n6. Repeat steps 2 - 5, to add:\n - **Mesh Configuration API**\n - **Cloud Monitoring API**\n - **Cloud Trace API**\n7. Click **Save**.\n\ngcloud\n\nTo update the list of restricted services, use the `update` command and\nspecify the services to add as a comma-delimited list:\n**Note:** If your service mesh uses Certificate Authority Service, then replace `meshca.googleapis.com` with `privateca.googleapis.com` in the following command. \n\n```bash\ngcloud access-context-manager perimeters update PERIMETER_NAME \\\n --add-restricted-services=meshconfig.googleapis.com,meshca.googleapis.com,monitoring.googleapis.com,cloudtrace.googleapis.com,OTHER_SERVICES \\\n --policy=POLICY_NAME\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e is the name of the service perimeter that you\n want to update.\n\n- \u003cvar translate=\"no\"\u003eOTHER_SERVICES\u003c/var\u003e is an optional comma-separated list\n of one or more services to include in the perimeter in addition to the\n services populated in the preceding command. For example:\n `storage.googleapis.com,bigquery.googleapis.com`.\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the numeric name of your organization's access\n policy. For example, `330193482019`.\n\nRefer to\n[Updating a service perimeter](/vpc-service-controls/docs/manage-service-perimeters#update)\nfor additional information."]]
