이 가이드에서는 Cloud Service Mesh를 사용하여 TCP 트래픽을 처리하는 서비스로 트래픽을 라우팅하는 방법을 보여줍니다. 이러한 서비스에는 특정 포트 또는 포트 범위에서 TCP 트래픽을 수신할 것으로 예상되는 데이터베이스, VOIP 서비스, 관리 플랫폼이 포함됩니다.
백엔드 서비스를 설정하는 마지막 단계는 백엔드를 추가하는 것입니다.
이 단계는 표준 Cloud Service Mesh 설정이므로(즉, TCP 기반 서비스에는 해당 없음) 여기에 표시되지 않습니다.
자세한 내용은 자동 Envoy 배포로 Compute Engine VM 설정 가이드의 백엔드 서비스 만들기를 참조하세요.
NEG 설정
NEG를 구성하는 경우 다음 명령어를 사용하여 백엔드 서비스를 만들고 상태 확인을 백엔드 서비스와 연결합니다.
백엔드 서비스를 설정하는 마지막 단계는 백엔드 그룹을 추가하는 것입니다. 이 단계는 표준 Cloud Service Mesh 설정이므로(즉, TCP 기반 서비스에는 해당 없음) 여기에 표시되지 않습니다.
자세한 내용은 자동 Envoy 삽입으로 GKE pod 설정 가이드의 백엔드 서비스 만들기를 참조하세요.
TCP 기반 백엔드 서비스의 라우팅 설정
이 섹션에서는 전역 대상 TCP 프록시 및 전역 전달 규칙을 만듭니다.
이러한 리소스는 애플리케이션이 새로 생성된 백엔드 서비스를 통하여 트래픽을 백엔드로 전송할 수 있도록 설정합니다.
다음 사항을 고려하세요.
전달 규칙에는 부하 분산 스키마 INTERNAL_SELF_MANAGED가 있어야 합니다.
전달 규칙에 구성된 가상 IP 주소(VIP) 및 포트는 트래픽을 TCP 서비스로 전송할 때 애플리케이션에서 사용하는 VIP 및 포트입니다. 서브넷 중 하나에서 VIP를 선택할 수 있습니다.
Cloud Service Mesh는 이 VIP 및 포트를 사용하여 클라이언트 요청을 특정 백엔드 서비스와 일치시킵니다.
클라이언트 요청을 백엔드 서비스와 일치시키는 방법에 대한 자세한 내용은 서비스 검색을 참조하세요.
gcloud
다음 명령어를 사용하여 대상 TCP 프록시를 만듭니다. BACKEND_SERVICE를 이전 단계에서 만든 백엔드 서비스의 이름으로 바꿉니다. 다음 예시에서는 td-tcp-proxy를 대상 TCP 프록시의 이름으로 사용하지만 필요에 맞는 이름을 선택할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-11(UTC)"],[],[],null,["# Set up TCP traffic routing\n==========================\n\nThis guide demonstrates how you can use Cloud Service Mesh to route traffic to services\nthat handle TCP traffic. These services include databases, VOIP services, and\nmanagement platforms, which expect to receive TCP traffic on specific ports or\nport ranges.\n| **Note:** This guide only supports Cloud Service Mesh with Google Cloud APIs and does not support Istio APIs. For more information see, [Cloud Service Mesh overview](/service-mesh/docs/overview).\n\nThis guide applies to deployment with the older APIs. If you are using the new\nservice routing APIs, which are in preview, see\n[Cloud Service Mesh setup for TCP services with a `TCPRoute` resource](/service-mesh/docs/service-routing/set-up-tcp-route).\n\nUse this guide to do the following:\n\n- Set up a service that represents a collection of identical backends or endpoints that accept TCP requests from clients.\n- Set up a routing rule map so that Envoy proxies that Cloud Service Mesh configures can send TCP requests.\n\nThe following diagrams show how TCP routing works for virtual machine (VM)\ninstances and network endpoint groups (NEGs), respectively.\n[](/static/service-mesh/docs/images/td-tcp-gce.svg) Setting up Cloud Service Mesh for TCP, Compute Engine backends (click to enlarge)\n\n\u003cbr /\u003e\n\n\n[](/static/service-mesh/docs/images/td-tcp-neg.svg) Setting up Cloud Service Mesh for TCP, NEG backends (click to enlarge)\n\n\u003cbr /\u003e\n\nPreparation\n-----------\n\n- This guide builds on the [Envoy for service mesh](/service-mesh/docs/service-routing/prepare-for-envoy-setup) preparation guide, and assumes that you already have a basic understanding of how Cloud Service Mesh works.\n- The guide focuses on aspects of Cloud Service Mesh setup that are different when you configure your services and routing for TCP traffic.\n- The guide assumes that you have already set up a managed instance group (MIG) or NEG.\n\nConfigure load-balancing resources\n----------------------------------\n\nUse the following steps to configure the load-balancing resources.\n\n### Create a TCP health check\n\n### Setup with VMs\n\nIf you are configuring MIGs, use the following command to create a global\nhealth check; replace \u003cvar translate=\"no\"\u003ePORT\u003c/var\u003e with the TCP port\nnumber that this health check monitors: \n\n```\ngcloud compute health-checks create tcp td-vm-health-check \\\n --global \\\n --port=PORT\n```\n\n### Setup with NEGs\n\nIf you are configuring NEGs, use the following command to create a health\ncheck: \n\n```\ngcloud compute health-checks create tcp td-gke-health-check \\\n --use-serving-port\n```\n\nFor more information about health checks, see the following:\n\n- [Creating health checks](/load-balancing/docs/health-checks) in the Cloud Load Balancing documentation\n- [`gcloud compute health-checks create tcp`](/sdk/gcloud/reference/compute/health-checks/create/tcp) in the `gcloud` command reference\n\n### Create a firewall rule for your health check\n\nThis rule enables health checks from Google Cloud's health checkers to reach\nyour backends. \n\n### gcloud\n\n```\ngcloud compute firewall-rules create fw-allow-health-checks \\\n --action=ALLOW \\\n --direction=INGRESS \\\n --source-ranges=35.191.0.0/16,130.211.0.0/22 \\\n --target-tags=TAGS \\\n --rules=tcp:80\n```\n\nFor more information about firewall rules for health checks, see the following:\n\n- [Firewall rules for health checks](/load-balancing/docs/health-checks#fw-rule) in the Cloud Load Balancing documentation\n- [`gcloud compute firewall-rules create`](/sdk/gcloud/reference/compute/firewall-rules/create) in the `gcloud` command reference (includes guidance for \u003cvar translate=\"no\"\u003eTAGS\u003c/var\u003e)\n\n### Create a backend service for your TCP backends\n\nThe backend service setup for TCP with Cloud Service Mesh differs slightly\nfrom the setup for HTTP. The following steps capture those differences. \n\n### Setup with VMs\n\nIf you are configuring MIGs, use the following\ncommand to create a backend service and add the health check: \n\n```\n gcloud compute backend-services create td-vm-service \\\n --global \\\n --load-balancing-scheme=INTERNAL_SELF_MANAGED \\\n --health-checks=td-vm-health-check \\\n --protocol=TCP \\\n --global-health-checks\n```\n\nThe final step for setting up your backend service is to add your backends.\nBecause this step is standard Cloud Service Mesh setup (in other\nwords, nothing specific for TCP-based services), it is not shown here.\nFor more information, see\n[Create the backend service](/service-mesh/docs/service-routing/set-up-gce-vms-auto#creating_the_backend_service)\nin the setup guide for Compute Engine VMs with automatic Envoy\ndeployment.\n\n### Setup with NEGs\n\nIf you are configuring NEGs, use the following commands to create a\nbackend service and associate the health check with the backend service: \n\n```\ngcloud compute backend-services create td-gke-service \\\n --global \\\n --health-checks=td-gke-health-check \\\n --protocol=TCP \\\n --load-balancing-scheme=INTERNAL_SELF_MANAGED\n```\n\nThe final step for setting up your backend service is to add your backend\ngroup. Because this step is standard Cloud Service Mesh setup (in other\nwords, nothing specific for TCP-based services), it is not shown here.\nFor more information, see\n[Create the backend service](/service-mesh/legacy/load-balancing-apis/set-up-gke-pods-auto#creating_the_backend_service)\nin the setup guide for GKE Pods with automatic Envoy injection.\n\n### Set up routing for your TCP-based backend service\n\nIn this section, you create a global\n[target TCP proxy](/load-balancing/docs/tcp)\nand a global [forwarding rule](/load-balancing/docs/forwarding-rule-concepts).\nThese resources enable your applications to send traffic to the backends with\nyour newly created backend services.\n\nConsider the following:\n\n- Your forwarding rule must have the load-balancing scheme `INTERNAL_SELF_MANAGED`.\n- The virtual IP address (VIP) and port that you configure in the forwarding\n rule are the VIP and port that your applications use when sending traffic to\n your TCP services. You can choose the VIP from one of your subnets.\n Cloud Service Mesh uses this VIP and port to match client requests to a\n particular backend service.\n\n For information about how client requests are matched to backend services, see\n [Service discovery](/service-mesh/docs/traffic-management/service-discovery#service_discovery).\n\n### gcloud\n\n1. Use the following command to create the target TCP proxy; replace\n \u003cvar translate=\"no\"\u003eBACKEND_SERVICE\u003c/var\u003e with the name of the backend service\n created in the previous step. In the following example, we use\n `td-tcp-proxy` as the name for the target TCP proxy, but you can choose\n a name that suits your needs.\n\n ```\n gcloud compute target-tcp-proxies create td-tcp-proxy \\\n --backend-service=BACKEND_SERVICE\n ```\n | **Note:** Each service that requires a different VIP address must use a different forwarding rule.\n2. Create the forwarding rule. The forwarding rule specifies the VIP and\n port that are used when matching client requests to a particular backend\n service. For more information, see\n [`gcloud compute forwarding-rules create`](/sdk/gcloud/reference/compute/forwarding-rules/create)\n in the `gcloud` command reference.\n\n ```\n gcloud compute forwarding-rules create td-tcp-forwarding-rule \\\n --global \\\n --load-balancing-scheme=INTERNAL_SELF_MANAGED \\\n --address=VIP\\\n --target-tcp-proxy=td-tcp-proxy \\\n --ports=PORT \\\n --network=default\n ```\n\nAt this point, Cloud Service Mesh is configured to load balance traffic for\nthe VIP specified in the forwarding rule across your backends.\n\nLimitations\n-----------\n\nYou cannot configure a Google Cloud Armor security policy if you are using\nTCP traffic routing.\n\nTroubleshooting\n---------------\n\nIf your applications are attempting to send requests to your TCP-based services,\ndo the following:\n\n- Confirm that the TCP health check port matches the port on which the TCP application expects to receive health check traffic.\n- Confirm that the port name of the backend service matches what is specified in the instance group.\n\nWhat's next\n-----------\n\n- [Prepare to set up Cloud Service Mesh with Envoy](/service-mesh/docs/service-routing/prepare-for-envoy-setup)\n- [Troubleshoot Envoy deployments](/service-mesh/docs/service-routing/troubleshooting)"]]
