Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menunjukkan cara membuat rentang alamat IP Virtual Private Cloud (VPC) yang diperlukan AlloyDB for PostgreSQL untuk akses layanan pribadi. Untuk mengetahui ringkasan cara AlloyDB menggunakan akses layanan pribadi agar resource internalnya dapat berkomunikasi satu sama lain, lihat Tentang akses layanan pribadi.
Untuk membuat konfigurasi akses layanan pribadi di jaringan Virtual Private Cloud (VPC) yang berada diGoogle Cloud project yang sama dengan cluster AlloyDB Anda, lakukan dua operasi:
Buat rentang alamat IP yang dialokasikan di jaringan VPC.
Buat koneksi pribadi antara jaringan VPC dan jaringan VPC Google Cloud yang mendasarinya.
Anda juga dapat mengonfigurasi akses layanan pribadi untuk menghubungkan cluster AlloyDB ke resource yang berada di projectGoogle Cloud terpisah. Untuk melakukannya, Anda harus menggabungkan jaringan VPC kedua project menggunakan VPC Bersama.
Untuk menyediakan ruang alamat yang memadai bagi AlloyDB, sebaiknya gunakan panjang awalan 16 atau kurang.
Untuk menentukan rentang alamat IP dan panjang awalan (subnet mask), gunakan flag --addresses dan --prefix-length. Misalnya, untuk mengalokasikan blok CIDR 192.168.0.0/16, tentukan 192.168.0.0 untuk alamat dan 16 untuk panjang awalan.
RESERVED_RANGE_NAME: nama untuk rentang yang dialokasikan, seperti my-allocated-range
DESCRIPTION: deskripsi untuk rentang, seperti
allocated for my-service
VPC_NETWORK: nama jaringan VPC Anda, seperti my-vpc-network. Jika menggunakan jaringan VPC Bersama, setel ke jalur yang memenuhi syarat sepenuhnya dari jaringan VPC—misalnya,
projects/cymbal-project/global/networks/shared-vpc-network.
Untuk hanya menentukan panjang awalan (subnet mask), gunakan flag
--prefix-length. Jika Anda menghilangkan rentang alamat IP,Google Cloud akan otomatis memilih rentang alamat IP yang tidak digunakan di jaringan VPC Anda.
Contoh berikut memilih rentang alamat IP yang tidak digunakan dengan panjang awalan 16 bit:
Contoh berikut membuat koneksi pribadi ke Google sehingga instance VM dalam jaringan VPC default dapat menggunakan akses layanan pribadi untuk menjangkau layanan Google yang mendukungnya.
gcloudcomputeaddressescreategoogle-managed-services-default\--global\--purpose=VPC_PEERING\--prefix-length=16\--description="peering range for Google"\--network=default
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-25 UTC."],[[["\u003cp\u003eThis page details how to configure Virtual Private Cloud (VPC) IP address ranges necessary for AlloyDB for PostgreSQL's private services access, enabling internal resource communication.\u003c/p\u003e\n"],["\u003cp\u003eSetting up private services access involves creating an allocated IP address range within the VPC network and establishing a private connection between the VPC network and the underlying Google Cloud VPC network.\u003c/p\u003e\n"],["\u003cp\u003eUsers must have specific IAM roles (such as \u003ccode\u003eroles/alloydb.admin\u003c/code\u003e, \u003ccode\u003eroles/owner\u003c/code\u003e, or \u003ccode\u003eroles/editor\u003c/code\u003e) and permissions (including \u003ccode\u003ecompute.networks.list\u003c/code\u003e, \u003ccode\u003ecompute.addresses.create\u003c/code\u003e, and \u003ccode\u003eservicenetworking.services.addPeering\u003c/code\u003e) to configure private services access.\u003c/p\u003e\n"],["\u003cp\u003eYou can allocate IP ranges manually by entering the desired CIDR block, or automatically by specifying only a prefix length for Google Cloud to select a free range; a prefix length of 16 or less is recommended.\u003c/p\u003e\n"],["\u003cp\u003ePrivate services access configuration can also connect AlloyDB to resources in a different Google Cloud project by using Shared VPC to merge the two projects' VPC networks.\u003c/p\u003e\n"]]],[],null,["# Enable private services access\n\nThis page shows you how to create the Virtual Private Cloud (VPC) IP address ranges that\nAlloyDB for PostgreSQL requires for private services\naccess. For an overview of how AlloyDB uses private services\naccess to let its internal resources communicate with each other, see\n[About private services access](/alloydb/docs/about-private-services-access).\n\nTo create a private services access configuration in a\nVirtual Private Cloud (VPC) network that resides in the same\nGoogle Cloud project as your AlloyDB cluster, you perform two operations:\n\n- Create an allocated IP address range in the VPC network.\n\n- Create a private connection between the VPC network and the underlying Google Cloud VPC network.\n You can also configure private services access to connect your\n AlloyDB cluster to resources residing in a separate\n Google Cloud project. To do this, you must merge the two projects'\n VPC networks [using Shared VPC](/alloydb/docs/about-private-services-access#shared).\n\n\n### Before you begin\n\n- The Google Cloud project you are using must have been [enabled to access AlloyDB](/alloydb/docs/project-enable-access).\n- You must have one of these IAM roles in the Google Cloud project you are using:\n - `roles/alloydb.admin` (the AlloyDB Admin predefined IAM role)\n - `roles/owner` (the Owner basic IAM role)\n - `roles/editor` (the Editor basic IAM role)\n\n If you don't have any of these roles, contact your Organization Administrator to request\n access.\n- To create a private services access configuration, you also must have these IAM permissions:\n - `compute.networks.list`\n - `compute.addresses.create`\n - `compute.addresses.list`\n - `servicenetworking.services.addPeering`\n\n\u003cbr /\u003e\n\nCreate VPC IP address ranges\n----------------------------\n\n### Console\n\n1. Go to the VPC networks page.\n\n [Go to VPC networks](https://console.cloud.google.com/networking/networks/list)\n2. Select the project where AlloyDB and the\n VPC network reside.\n\n3. Click the name of VPC network that you want to use for private\n services access.\n\n | **Note:** The default VPC network is created for most consumer projects, and is best suited if you're beginning your experimentation with AlloyDB.\n4. On the **VPC network details** page, scroll through the list of tabs to\n the **Private service access** tab and then click it.\n\n5. In the **Private service access** tab, click the **Allocated IP\n ranges for services** tab.\n\n6. Click **Allocate IP range**.\n\n7. In the **Name** and **Description** fields, enter a name and a\n description for the allocated range.\n\n8. Specify an **IP range** value for the allocation:\n\n - To specify an IP address range, click **Custom** , and then enter a CIDR\n block, such as `192.168.0.0/16`.\n\n To provide sufficient address space for AlloyDB,\n we recommend a prefix length of `16` or less.\n - To specify a prefix length and let Google select an available range,\n follow these steps:\n\n 1. Click **Automatic**.\n\n 2. Enter a prefix length as a plain number, such as `16`.\n\n9. Click **Allocate** to create the allocated range.\n\n10. In the **Private service access** tab, click the **Private\n connections to services** tab.\n\n11. Click **Create connection** to create a private connection between your\n network and a service producer.\n\n12. Make sure that Google Cloud Platform is the\n **Connected service producer**.\n\n13. For the **Assigned allocation**, select the allocated IP range you\n created earlier.\n\n14. Click **Connect** to create the connection.\n\n### gcloud\n\n\nTo use the gcloud CLI, you can\n[install and initialize](/sdk/docs/install) the Google Cloud CLI, or you\ncan use [Cloud Shell](/shell/docs/using-cloud-shell).\n\n\u003cbr /\u003e\n\n1. Use the [`gcloud config set`](/sdk/gcloud/reference/config/set)\n command to set the default project\n to the one where AlloyDB and the VPC\n network reside.\n\n gcloud config set project \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the ID of the project where\n AlloyDB and the VPC network reside.\n2. Use the [`gcloud compute addresses create`](/sdk/gcloud/reference/compute/addresses/create) command to create an\n allocated IP\n address range.\n\n To provide sufficient address space for AlloyDB, we\n recommend a prefix length of `16` or less.\n - To specify an address range and a prefix length (subnet mask), use the\n `--addresses` and `--prefix-length` flags. For example, to allocate the CIDR\n block `192.168.0.0/16`, specify `192.168.0.0` for the address and `16` for\n the prefix length.\n\n gcloud compute addresses create \u003cvar translate=\"no\"\u003eRESERVED_RANGE_NAME\u003c/var\u003e \\\n --global \\\n --purpose=VPC_PEERING \\\n --addresses=192.168.0.0 \\\n --prefix-length=16 \\\n --description=\"\u003cvar translate=\"no\"\u003eDESCRIPTION\u003c/var\u003e\" \\\n --network=\u003cvar translate=\"no\"\u003eVPC_NETWORK\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eRESERVED_RANGE_NAME\u003c/var\u003e: a name for the allocated range,\n such as `my-allocated-range`\n\n - \u003cvar translate=\"no\"\u003eDESCRIPTION\u003c/var\u003e: a description for the range, such as\n `allocated for my-service`\n\n - \u003cvar translate=\"no\"\u003eVPC_NETWORK\u003c/var\u003e: the name of your VPC\n network, such as `my-vpc-network`. In case of Shared VPC network, set to the fully qualified path of the VPC network---for example,\n `projects/cymbal-project/global/networks/shared-vpc-network`.\n\n - To specify only a prefix length (subnet mask), use the\n `--prefix-length` flag. When you omit the address range,\n Google Cloud automatically selects an unused address range in\n your VPC network.\n\n The following example selects an unused\n IP address range with a `16` bit prefix length: \n\n gcloud compute addresses create \u003cvar translate=\"no\"\u003eRESERVED_RANGE_NAME\u003c/var\u003e \\\n --global \\\n --purpose=VPC_PEERING \\\n --prefix-length=16 \\\n --description=\"\u003cvar translate=\"no\"\u003eDESCRIPTION\u003c/var\u003e\" \\\n --network=\u003cvar translate=\"no\"\u003eVPC_NETWORK\u003c/var\u003e\n\n The following example creates a private connection to Google so that the VM\n instances in the `default` VPC network can use private\n services access to reach Google services that support it. \n\n gcloud compute addresses create google-managed-services-default \\\n --global \\\n --purpose=VPC_PEERING \\\n --prefix-length=16 \\\n --description=\"peering range for Google\" \\\n --network=default\n\n3. Use the [`gcloud services vpc-peerings connect`](/sdk/gcloud/reference/services/vpc-peerings/connect)\n command to create a private\n connection.\n\n gcloud services vpc-peerings connect \\\n --service=servicenetworking.googleapis.com \\\n --ranges=\u003cvar translate=\"no\"\u003eRESERVED_RANGE_NAME\u003c/var\u003e \\\n --network=\u003cvar translate=\"no\"\u003eVPC_NETWORK\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eRESERVED_RANGE_NAME\u003c/var\u003e: the name of the allocated IP\n address range you created\n\n - \u003cvar translate=\"no\"\u003eVPC_NETWORK\u003c/var\u003e: the name of your VPC\n network\n\n The command initiates a long-running operation, returning an operation name.\n4. Check whether the operation was successful.\n\n gcloud services vpc-peerings operations describe\n --name=\u003cvar translate=\"no\"\u003eOPERATION_NAME\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eOPERATION_NAME\u003c/var\u003e with the operation name that was\n returned from the previous step.\n\nWhat's Next\n-----------\n\n- [Create a cluster and its primary instance.](/alloydb/docs/cluster-create)"]]
