当您将 Google Cloud 外部的集群注册到舰队时， Google Cloud 会使用名为 Connect Agent 的 Deployment 在集群和您的 Google Cloud项目之间建立连接，并处理 Kubernetes 请求。为在 Google Cloud中运行的 GKE 集群建立连接不需要使用 Connect Agent。
这样，您就能够在 Google Cloud中访问集群和工作负载管理功能（包括统一界面Google Cloud 控制台），以便与集群进行交互。
如果您的网络配置为允许出站请求，则可以将 Connect Agent 配置为遍历 NAT、出站流量代理和防火墙，以在集群的 Kubernetes API 服务器和 Google Cloud 项目之间建立长期的加密连接。启用此连接后，您可以使用自己的凭据重新登录集群并访问有关其 Kubernetes 资源的详细信息。这实际上复制了仅以其他方式提供给 GKE 集群使用的界面体验。
建立连接后，Connect Agent 软件可以交换账号凭证、技术详细信息，以及使用 Google Cloud管理它们所需的已连接基础设施和工作负载的元数据，包括资源、应用和硬件的详细信息。
此集群服务数据与您的 Google Cloud 项目和账号关联。Google 会使用这些数据在集群和 Google Cloud之间维护控制平面，以便为您提供所请求的任何 Google Cloud服务和功能（包括协助提供支持、进行结算、提供更新），以及衡量和改进 Connect 及通过 Connect 提供的 Google Cloud 服务的可靠性、质量、容量和功能。
您需要提供特定的 IAM 角色才能启动 Connect Agent，并使用 Google Cloud 控制台或 Google Cloud CLI 与集群进行交互。这些角色不允许直接访问连接的集群。 如需详细了解如何通过 Google Cloud 控制台登录集群，请参阅通过 Google Cloud 控制台使用集群。
其中一些角色允许您访问有关集群的信息，包括：
集群名称
公钥
IP 地址
身份提供商
Kubernetes 版本
集群大小
其他集群元数据
Connect 使用以下 IAM 角色：
角色名称
角色名称
说明
权限
roles/gkehub.editor
Hub Editor
提供对 GKE Hub 资源的修改权限。
Google Cloud的权限
resourcemanager.projects.get
resourcemanager.projects.list
Hub 的权限
gkehub.memberships.list
gkehub.memberships.get
gkehub.memberships.create
gkehub.memberships.update
gkehub.memberships.delete
gkehub.memberships.generateConnectManifest
gkehub.memberships.getIamPolicy
gkehub.locations.list
gkehub.locations.get
gkehub.operations.list
gkehub.operations.get
gkehub.operations.cancel
gkehub.features.list
gkehub.features.get
gkehub.features.create
gkehub.features.update
gkehub.features.delete
gkehub.features.getIamPolicy
gkehub.fleet.*
gkehub.membershipfeatures.list
gkehub.membershipfeatures.get
gkehub.membershipfeatures.create
gkehub.membershipfeatures.update
gkehub.membershipfeatures.delete
roles/gkehub.viewer
Hub Viewer
提供 Hub 和相关资源的只读访问权限。
Google Cloud的权限
resourcemanager.projects.get
resourcemanager.projects.list
Hub 的权限
gkehub.memberships.list
gkehub.memberships.get
gkehub.memberships.generateConnectManifest
gkehub.memberships.getIamPolicy
gkehub.locations.list
gkehub.locations.get
gkehub.operations.list
gkehub.operations.get
gkehub.features.list
gkehub.features.get
gkehub.features.getIamPolicy
gkehub.membershipfeatures.list
gkehub.membershipfeatures.get
roles/gkehub.connect
GKE Connect Agent
提供在外部集群和 Google 之间建立新连接的能力。
gkehub.endpoints.connect
资源用量和要求
通常，注册时安装的 Connect 代理会使用 500m 的 CPU 和 200Mi 的内存。但是，此使用情况可能因每秒向代理发出的请求数以及这些请求的大小而异。这些内容可能受到许多因素的影响，包括集群的大小、通过 Google Cloud 控制台访问集群的用户数（用户数和/或工作负载越多，请求次数越多）以及集群上支持舰队的功能数量。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-31。"],[],[],null,["# Connect Agent overview\n\nWhen you register a cluster outside Google Cloud to your fleet, Google Cloud uses a [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) called the *Connect Agent* to\nestablish a connection between the cluster and your Google Cloud\nproject, and to handle Kubernetes requests. The Connect Agent is not required to establish a connection for GKE clusters running in Google Cloud.\n\nThis enables access to cluster and to workload management\nfeatures in Google Cloud, including a unified user interface,\n[Google Cloud console](/cloud-console), to interact with your cluster.\n\nIf your network is configured to allow outbound requests, you can configure the\nConnect Agent to traverse NATs, egress proxies, and firewalls to establish\na long-lived, encrypted connection between your cluster's Kubernetes API server\nand your Google Cloud project. Once this connection is enabled, you can\nuse your own credentials to log back into your clusters and access details\nabout their Kubernetes resources. This effectively replicates the UI experience\nthat is otherwise only available to GKE clusters.\n\nAfter the connection is established, the Connect Agent software can exchange\naccount credentials, technical details, and metadata about connected\ninfrastructure and workloads necessary to manage them with Google Cloud,\nincluding the details of resources, applications, and hardware.\n\nThis cluster service data is associated with your Google Cloud project\nand account. Google uses this data to maintain a control plane between your\ncluster and Google Cloud, to provide you with any Google Cloud\nservices and features you request, including facilitating support, billing,\nproviding updates, and to measure and improve the reliability, quality,\ncapacity, and functionality of Connect and Google Cloud services\navailable through Connect.\n\nYou remain in control of what data is sent through Connect: your\nKubernetes API server performs [authentication](https://kubernetes.io/docs/reference/access-authn-authz/authentication/),\n[authorization](https://kubernetes.io/docs/reference/access-authn-authz/authorization/), and [audit logging](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/) on all requests via\nConnect. Google and users can access data or APIs via Connect\nafter they have been authorized by the cluster administrator (for example, via\n[RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)); the cluster administrator can revoke that authorization.\n\nConnect IAM roles\n-----------------\n\n[Identity and Access Management (IAM)](/iam/docs) allows users, groups, and\nservice accounts to access Google Cloud APIs and to perform tasks within\nGoogle Cloud products.\n\nYou need to provide specific IAM\n[roles](/iam/docs/understanding-roles) to launch the Connect Agent and\ninteract with your cluster using the Google Cloud console or Google Cloud CLI. These\nroles do not allow direct access to connected clusters. You can learn more about\nlogging in to clusters from the Google Cloud console in [Working with clusters from the Google Cloud console](/kubernetes-engine/fleet-management/docs/console).\n\nSome of these roles allow you to access information about clusters, including:\n\n- Cluster names\n- Public keys\n- IP addresses\n- Identity providers\n- Kubernetes versions\n- Cluster size\n- Other cluster metadata\n\nConnect uses the following IAM roles:\n\nResource usage and requirements\n-------------------------------\n\nTypically the Connect agent installed at registration uses 500m of CPU and 200Mi of memory. However, this usage can vary depending on the number of requests being made to the agent per second, and the size of those requests. These can be affected by a number of factors, including the size of the cluster, the number of users accessing the cluster via the Google Cloud console (the more users and/or workloads, the more requests), and the number of [fleet-enabled features](/kubernetes-engine/fleet-management/docs/fleet-concepts#fleet-enabled-components) on the cluster."]]
