Kubernetes 集群由控制平面和称为“节点”的工作器机器组成。控制平面和节点构成 Kubernetes 集群编排系统。GKE on GDC 负责管理集群的整个底层基础设施，包括控制平面和所有系统组件。您需要负责管理运行容器化工作负载的工作器节点。
下图显示了 Kubernetes 集群的架构：
关于控制平面
控制平面运行 Kubernetes API 服务器、调度器和核心资源控制器等进程。GKE on GDC 管理从集群创建到删除的控制平面生命周期。其中包括对控制平面上运行的 Kubernetes 版本的升级。GDC 会自动执行这项升级工作，如果您希望在安排的自动升级时间之前进行升级，也可以请求手动执行。
控制平面和 Kubernetes API
控制平面是集群的统一端点。您可以通过 Kubernetes API 调用与控制平面进行交互。控制平面运行 Kubernetes API 服务器进程 (kube-apiserver) 以处理 API 请求。您可以通过以下方式调用 Kubernetes API：
直接调用：KRM
间接调用：Kubernetes 命令行客户端（例如 kubectl）或 GDC 控制台。
API 服务器进程是集群所有通信的中心。所有内部集群组件（如节点、系统进程和应用控制器）都充当 API 服务器的客户端。
您的 API 请求会告诉 Kubernetes 集群中对象的所选状态。Kubernetes 会尝试持续保持该状态。Kubernetes 支持您以命令方式或声明方式配置 API 中的对象。
工作器节点管理
控制平面会管理集群的所有节点上运行的内容。控制平面安排工作负载并管理工作负载的生命周期、扩缩和升级。此外，控制平面还会管理这些工作负载的网络和存储资源。控制平面和节点使用 Kubernetes API 相互通信。
节点简介
节点是运行容器化应用和其他工作负载的工作器机器。各个机器是 GKE on GDC 创建的虚拟机 (VM)。控制平面会管理和接收每个节点自行报告的状态更新。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eGoogle Distributed Cloud (GDC) air-gapped offers a managed Kubernetes service with GKE Enterprise features, enabling the deployment and operation of container workloads in a disconnected environment.\u003c/p\u003e\n"],["\u003cp\u003eGKE on GDC includes enterprise capabilities such as multi-cluster lifecycle management, a fully supported Kubernetes distribution, cost visibility, multi-team management, GitOps-based configuration management, managed service mesh, and policy control.\u003c/p\u003e\n"],["\u003cp\u003eGDC utilizes two main cluster types: the org infrastructure cluster, which handles control and data plane components and the management API, and the Kubernetes cluster (or user cluster), which runs container-based workloads.\u003c/p\u003e\n"],["\u003cp\u003eThe control plane in GKE on GDC, which manages cluster operations, is automatically maintained by GKE, including upgrades, while users manage worker nodes that execute containerized workloads.\u003c/p\u003e\n"],["\u003cp\u003eCertain GKE capabilities, such as Connect gateway, attaching multicloud clusters, Binary Authorization, and Multi-cluster Data transfer, are not available in GKE on GDC.\u003c/p\u003e\n"]]],[],null,["# Kubernetes cluster overview\n\nGoogle Distributed Cloud (GDC) air-gapped provides a managed Kubernetes service with\n[Google Kubernetes Engine (GKE) Enterprise edition](/kubernetes-engine/docs/concepts/gke-editions#why),\nletting you deploy and run container workloads using industry standard\nKubernetes methodologies. GKE on GDC brings core features and\nfunctionality of GKE Enterprise to a disconnected environment.\nAdditional GKE Enterprise features will be available for\nGKE on GDC over time.\n\nGKE on GDC provides enterprise features such as:\n\n- Multi-cluster lifecycle management\n- Fully supported Kubernetes distribution\n- Cost visibility\n- Multi-team management\n- GitOps-based configuration management\n- Managed service mesh\n- Policy control\n\nAll of these features come standard with GKE on GDC, and are available\nfor use with clusters created by the managed Kubernetes service.\n\nFor the purposes of documentation, GKE on GDC clusters are termed as\n*Kubernetes clusters* or *Clusters*.\n\nGDC cluster architecture\n------------------------\n\nKubernetes clusters are logically separated from each other to provide different\nfailure domains and isolation guarantees. In some cases, they are even\nphysically separated. Each organization in GDC has a\ndedicated set of Kubernetes clusters. The following cluster types are available\nspecifically for your workloads and services in each organization:\n\n- **Org infrastructure cluster**: Runs the control plane and data plane components of the organization. It also hosts the management API server where all non-container workloads and services are deployed.\n- **Kubernetes cluster** : Runs container-based workloads for the organization. The number of worker nodes depends on the utilization of the cluster. You can scale them as your needs evolve. A Kubernetes cluster is sometimes referred to as a *user cluster* in Distributed Cloud.\n\nWhen your Infrastructure Operator (IO) creates an organization,\nGDC automatically generates the org infrastructure\ncluster. The initial configuration for the org infrastructure cluster is set\nduring organization creation.\n\nAs an Administrator, you create and manage Kubernetes clusters. This section of topics\ncovers the management of Kubernetes clusters. Your containerized Kubernetes workloads\nall run in a Kubernetes cluster. For more information on creating and managing\ncontainers in a Kubernetes cluster, see the\n[Deploy container workloads](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/containers/containers-intro)\nsection.\n\nA Kubernetes cluster consists of a control plane and worker machines called nodes. The\ncontrol plane and nodes make up the Kubernetes cluster orchestration system.\nGKE on GDC manages the entire underlying infrastructure of clusters,\nincluding the control plane and all system components. You are responsible for\nmanaging the worker nodes that run your containerized workloads.\n\nThe following diagram shows the architecture of a Kubernetes cluster:\n\nAbout the control plane\n-----------------------\n\nThe control plane runs processes such as the Kubernetes API server, scheduler,\nand core resource controllers. GKE on GDC manages the control plane\nlifecycle from cluster creation to deletion. This includes upgrades to the\nKubernetes version running on the control plane, which\nGDC performs automatically, or manually at your request\nif you prefer to upgrade earlier than the automatic schedule.\n\n### Control plane and the Kubernetes API\n\nThe control plane is the unified endpoint for your cluster. You interact with\nthe control plane through Kubernetes API calls. The control plane runs the\nKubernetes API server process, or `kube-apiserver`, to handle API requests. You\ncan make Kubernetes API calls in the following ways:\n\n- Direct calls: KRM\n- Indirect calls: Kubernetes command-line clients, such as `kubectl`, or the GDC console.\n\nThe API server process is the hub for all communication for the cluster. All\ninternal cluster components such as nodes, system processes, and application\ncontrollers act as clients of the API server.\n\nYour API requests tell Kubernetes what your chosen state is for the objects in\nyour cluster. Kubernetes attempts to constantly maintain that state. Kubernetes\nlets you configure objects in the API either *imperatively* or *declaratively*.\n\n### Worker node management\n\nThe control plane manages what runs on all of the cluster's nodes. The control\nplane schedules workloads and manages the workloads' lifecycle, scaling, and\nupgrades. The control plane also manages network and storage resources for those\nworkloads. The control plane and nodes communicate with each other using\nKubernetes APIs.\n\nAbout nodes\n-----------\n\nNodes are the worker machines that run your containerized applications and other\nworkloads. The individual machines are virtual machines (VMs) that\nGKE on GDC creates. The control plane manages and receives updates on\neach node's self-reported status.\n\nA node runs the services necessary to support the containers that make up your\ncluster's workloads. These include the runtime and the Kubernetes node agent, or\nkubelet, which communicates with the control plane and is responsible for\nstarting and running containers scheduled on the node.\n\nGKE on GDC also runs a number of system containers that run as per-node\nagents, called DaemonSets, that provide features such as log collection and\nintra-cluster network connectivity.\n\nLimitations for GKE on GDC\n--------------------------\n\nThe following GKE capabilities are limitations not available for\nGKE on GDC:\n\n- Connect gateway\n- Attaching multicloud clusters\n- Binary Authorization\n- Multi-cluster Data transfer in"]]
