Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menunjukkan cara mengaktifkan dan menggunakan batasan kustom dalam lingkungan cluster terlampir GKE Anda. Google Cloud's Organization Policy Service membantu Anda mengelola konfigurasi resource dan membuat batas aman di lingkungan cloud Anda.
Ringkasan
Dengan kebijakan organisasi kustom, Anda dapat membuat kebijakan resource terperinci di seluruh lingkungan Multi-Cloud GKE untuk memenuhi persyaratan keamanan dan kepatuhan spesifik organisasi Anda. Anda juga dapat membuat kebijakan organisasi dalam mode uji coba untuk menguji kebijakan baru tanpa memengaruhi beban kerja produksi Anda.
Sebelum memulai, pastikan Anda memahami topik berikut:
Pewarisan kebijakan
Secara default, kebijakan organisasi diwarisi oleh turunan resource tempat Anda menerapkan kebijakan tersebut. Misalnya, jika Anda menerapkan kebijakan pada organisasi, Google Cloud akan menerapkan kebijakan tersebut pada semua project di organisasi. Untuk mempelajari lebih lanjut pewarisan kebijakan dan cara mengubah aturan evaluasi, lihat Aturan evaluasi hierarki.
Batasan
Sebelum membuat batasan kustom, perhatikan batasan berikut:
Batasan kustom hanya dapat diterapkan pada metode CREATE atau UPDATE untuk resource cluster terlampir GKE.
Batasan kustom yang baru diterapkan tidak otomatis berlaku untuk resource yang ada. Anda harus mengupdate resource yang ada untuk menerapkan batasan.
Untuk menemukan resource yang ada yang perlu diupdate, Anda dapat menerapkan kebijakan organisasi uji coba.
Untuk membuat batasan dan menerapkan kebijakan organisasi, Anda memerlukan peran IAM Administrator Kebijakan Organisasi (roles/orgpolicy.policyAdmin) di Google Cloud organisasi Anda. Untuk mengetahui informasi selengkapnya tentang izin yang diperlukan untuk mengelola kebijakan organisasi dengan batasan kustom, lihat Peran yang diperlukan.
Harga
Kebijakan organisasi dan batasan kustom ditawarkan tanpa biaya.
Untuk membuat batasan khusus baru, tentukan batasan dalam file YAML dan terapkan batasan khusus di organisasi Anda menggunakan Google Cloud CLI. Batasan ini harus mencakup kebijakan spesifik yang ingin Anda terapkan di seluruh resource cluster terlampir GKE.
ORGANIZATION_ID : ID organisasi Anda, seperti 123456789.
CONSTRAINT_NAME : nama batasan kustom baru Anda. Batasan kustom harus diawali dengan custom., dan hanya boleh menyertakan huruf besar, huruf kecil, atau angka. Misalnya, custom.allowClusterCreateIfAnnotationPresent. Panjang maksimum kolom ini adalah 70 karakter, tidak menghitung awalan, misalnya, organizations/123456789/customConstraints/custom.
CONDITION : kondisi yang ditulis berdasarkan representasi resource cluster terlampir. Kondisi ditulis dalam Common Expression Language (CEL). Kolom ini memiliki panjang maksimal 1.000 karakter.
Misalnya, kondisi: "key" in resource.annotations && resource.annotations.key == "created-by".
ACTION : tindakan yang akan diambil jika kondisi terpenuhi. Ini dapat berupa ALLOW atau DENY.
DISPLAY_NAME : nama tampilan untuk batasan. Kolom ini memiliki panjang maksimal 200 karakter.
DESCRIPTION : deskripsi batasan untuk ditampilkan sebagai pesan error saat kebijakan dilanggar, misalnya, "Allow new clusters only when certain annotations are set."Kolom ini memiliki panjang maksimal 2.000 karakter.
Untuk mengetahui informasi selengkapnya tentang cara membuat batasan kustom, lihat Menentukan batasan kustom.
Mengaitkan batasan dengan resource Anda
Setelah membuat file YAML untuk batasan khusus baru, Anda harus menyiapkannya agar batasan tersebut tersedia untuk kebijakan organisasi.
Untuk menyiapkan batasan kustom, gunakan perintah gcloud org-policies set-custom-constraint:
CUSTOM_CONSTRAINT:custom.allowClusterCreateIfAnnotationPresentACTION_TYPE:ALLOWMETHOD_TYPES:CREATERESOURCE_TYPES:gkemulticloud.googleapis.com/AttachedClusterDISPLAY_NAME:Allow new clusters only when certain annotations are set.
Menerapkan batasan khusus
Untuk menerapkan batasan khusus baru, buat kebijakan organisasi yang merujuk ke batasan tersebut, lalu terapkan kebijakan organisasi.
RESOURCE_HIERARCHY: lokasi kebijakan baru, yang memengaruhi cakupan penegakan. Gunakan hierarki resource Google Cloud sebagai panduan. Misalnya, jika Anda ingin menerapkan kebijakan pada project tertentu, gunakan projects/PROJECT_ID. Untuk menerapkan kebijakan di organisasi tertentu, gunakan organizations/ORGANIZATION_ID.
POLICY_NAME: nama kebijakan baru.
Terapkan kebijakan:
gcloudorg-policiesset-policyPATH_TO_POLICY
Ganti PATH_TO_POLICY dengan jalur ke file definisi kebijakan Anda.
Pastikan kebijakan ada:
gcloudorg-policieslist--RESOURCE_FLAG=RESOURCE_ID
Ganti kode berikut:
RESOURCE_FLAG: resource Google Cloud tempat Anda menerapkan kebijakan. Misalnya, project atau organisasi.
RESOURCE_ID: ID resource tempat Anda menerapkan kebijakan. Misalnya, project ID atau ID organisasi Anda.
ERROR:(gcloud.container.attached.clusters.register)FAILED_PRECONDITION:Operationdeniedbyorgpolicyonresource'projects/PROJECT_NUMBER/locations/GOOGLE_CLOUD_REGION':["customConstraints/custom.allowClusterCreateIfAnnotationPresent":"Allow new clusters only when certain annotations are set."]'@type':type.googleapis.com/google.rpc.ErrorInfo
domain:googleapis.com
metadata:
customConstraints:customConstraints/custom.allowClusterCreateIfAnnotationPresent
service:gkemulticloud.googleapis.com
reason:CUSTOM_ORG_POLICY_VIOLATION
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-07-14 UTC."],[],[],null,["# Create and manage custom constraints\n\nThis page shows you how to enable and use custom constraints within your GKE attached clusters environment. Google Cloud's [Organization Policy Service](/resource-manager/docs/organization-policy/overview) helps you manage resource configurations and create guardrails in your cloud environment.\n\nOverview\n--------\n\nWith custom organization policies, you can create granular resource policies across GKE Multi-Cloud environments to meet your organization's specific security and compliance requirements. You can also create organization policies in dry-run mode to test new policies without affecting your production workloads.\n\nTo learn more about organization policies, see [Introduction to the Organization Policy Service](/resource-manager/docs/organization-policy/overview#custom-organization-policies).\n\nBefore you begin\n----------------\n\nBefore you start, make sure you understand the following topics:\n\n### Policy inheritance\n\nBy default, organization policies are inherited by the descendants of the resources on which you enforce the policy. For example, if you enforce a policy on an organization, Google Cloud enforces the policy on all projects in the organization. To learn more about policy inheritance and how to change evaluation rules, see [Hierarchy evaluation rules](/resource-manager/docs/organization-policy/understanding-hierarchy#disallow_inheritance).\n\n### Limitations\n\nBefore you create custom constraints, keep in mind the following limitations:\n\n- Custom constraints can only be enforced on the `CREATE` or `UPDATE` methods for GKE attached clusters resources.\n- Newly enforced custom constraints don't automatically apply to existing resources. You must update existing resources to apply the constraint. To find existing resources that need to be updated, you can enforce a [dry-run organization policy](/resource-manager/docs/organization-policy/dry-run-policy).\n- To create constraints and enforce organization policies, you need the [Organization Policy Administrator](/iam/docs/understanding-roles#orgpolicy.policyAdmin) (`roles/orgpolicy.policyAdmin`) IAM role on your Google Cloud organization. For more information about the permissions required to manage organization policies with custom constraints, see [Required roles](/resource-manager/docs/organization-policy/creating-managing-custom-constraints#required-roles).\n\n### Pricing\n\nOrganizational policies and custom constraints are offered at no charge.\n| **Note:** This guide provides a general overview. Specific gcloud commands may vary based on your exact configuration and required policy enforcement.\n\nCreate custom constraints\n-------------------------\n\nCustom constraints must be specified by using the fields in the AttachedCluster [API resource spec](/kubernetes-engine/multi-cloud/docs/reference/rest/v1/projects.locations.attachedClusters#AttachedCluster), excluding fields that are described as \"Output only\".\n\n### Create a custom constraint\n\nTo create a new custom constraint, you define the constraint in a YAML file and apply the custom constraint in your organization using the Google Cloud CLI. This constraint must encapsulate the specific policy you want to enforce across your GKE attached clusters resources.\n\n1. Create a YAML file for the custom constraint:\n\n name: organizations/\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e/customConstraints/\u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e\n resourceTypes:\n - gkemulticloud.googleapis.com/AttachedCluster\n methodTypes: \n - CREATE\n condition: \\\"\u003cvar translate=\"no\"\u003eCONDITION\u003c/var\u003e\\\"\n actionType: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eACTION\u003c/span\u003e\u003c/var\u003e\n displayName: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eDISPLAY_NAME\u003c/span\u003e\u003c/var\u003e\n description: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eDESCRIPTION\u003c/span\u003e\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e : your organization ID, such as `123456789`.\n\n - \u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e : the name of your new custom constraint. A custom constraint must start with `custom.`, and can only include uppercase letters, lowercase letters, or numbers. For example, `custom.allowClusterCreateIfAnnotationPresent`. The maximum length of this field is 70 characters, not counting the prefix, for example, `organizations/123456789/customConstraints/custom`.\n\n - \u003cvar translate=\"no\"\u003eCONDITION\u003c/var\u003e : a condition that is written against a representation of an attached cluster resource. Conditions are written in [Common Expression Language (CEL)](/resource-manager/docs/organization-policy/creating-managing-custom-constraints#common_expression_language). This field has a maximum length of 1,000 characters.\n For example, condition: `\"key\" in resource.annotations && resource.annotations.key == \"created-by\"`.\n\n - \u003cvar translate=\"no\"\u003eACTION\u003c/var\u003e : the action to take if the condition is met. This can be either `ALLOW` or `DENY`.\n\n - \u003cvar translate=\"no\"\u003eDISPLAY_NAME\u003c/var\u003e : a display name for the constraint. This field has a maximum length of 200 characters.\n\n - \u003cvar translate=\"no\"\u003eDESCRIPTION\u003c/var\u003e : a description of the constraint to display as an error message when the policy is violated, for example, `\"Allow new clusters only when certain annotations are set.\"` This field has a maximum length of 2,000 characters.\n\n For more information about how to create a custom constraint, see [Defining custom constraints](/resource-manager/docs/organization-policy/creating-managing-custom-constraints#defining_custom_constraints).\n\n### Associate the constraint with your resources\n\nAfter you have created the YAML file for a new custom constraint, you must set it up to make the constraint available for organization policies.\n\n1. To set up a custom constraint, use the `gcloud org-policies set-custom-constraint` command:\n\n gcloud org-policies set-custom-constraint \u003cvar translate=\"no\"\u003ePATH_TO_FILE\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003ePATH_TO_FILE\u003c/var\u003e with the path of your custom constraint YAML definition.\n2. To verify that the custom constraint is created, use the `gcloud org-policies list-custom-constraints` command:\n\n gcloud org-policies list-custom-constraints --organization=\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e\n\n The output lists the created policies: \n\n CUSTOM_CONSTRAINT: custom.allowClusterCreateIfAnnotationPresent\n ACTION_TYPE: ALLOW\n METHOD_TYPES: CREATE\n RESOURCE_TYPES: gkemulticloud.googleapis.com/AttachedCluster\n DISPLAY_NAME: Allow new clusters only when certain annotations are set.\n\nEnforce the custom constraint\n-----------------------------\n\nTo enforce the new custom constraint, create an organization policy that references the constraint, and then apply the organization policy.\n\n1. Create a YAML file for the organization policy:\n\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eRESOURCE_HIERARCHY\u003c/span\u003e\u003c/var\u003e/policies/\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e\n spec:\n rules:\n - enforce: true\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eRESOURCE_HIERARCHY\u003c/var\u003e: the location of the new policy, which affects the scope of enforcement. Use the Google Cloud resource hierarchy as a guide. For example, if you want to enforce the policy in a specific project, use `projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e. To enforce the policy in a specific organization, use `organizations/`\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e.\n\n - \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the name of the new policy.\n\n2. Enforce the policy:\n\n gcloud org-policies set-policy \u003cvar translate=\"no\"\u003ePATH_TO_POLICY\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003ePATH_TO_POLICY\u003c/var\u003e with the path to your policy definition file.\n3. Verify that the policy exists:\n\n gcloud org-policies list --\u003cvar translate=\"no\"\u003eRESOURCE_FLAG\u003c/var\u003e=\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eRESOURCE_FLAG\u003c/var\u003e: the Google Cloud resource where you enforced the policy. For example, a project or organization.\n\n - \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: the ID of the resource where you enforced the policy. For example, your project ID or organization ID.\n\n The output is similar to the following: \n\n CONSTRAINT: custom.allowClusterCreateIfAnnotationPresent\n LIST_POLICY: -\n BOOLEAN_POLICY: SET\n ETAG: CPjb27wGEOijhL4B-\n\nTest the policy\n---------------\n\nTest the organization policy by registering an EKS cluster in a restricted project.\n\n1. Register an EKS cluster in a restricted project.\n\n gcloud container attached clusters register CLUSTER_NAME \\\n --location=GOOGLE_CLOUD_REGION \\\n --fleet-project=PROJECT_NUMBER \\\n --platform-version=PLATFORM_VERSION \\\n --distribution=eks \\\n --issuer-url=ISSUER_URL \\\n --context=KUBECONFIG_CONTEXT \\\n --kubeconfig=KUBECONFIG_PATH\n\n2. The output is similar to the following:\n\n ERROR: (gcloud.container.attached.clusters.register) FAILED_PRECONDITION: Operation denied by org policy on resource 'projects/PROJECT_NUMBER/locations/GOOGLE_CLOUD_REGION': [\"customConstraints/custom.allowClusterCreateIfAnnotationPresent\": \"Allow new clusters only when certain annotations are set.\"]\n\n '@type': type.googleapis.com/google.rpc.ErrorInfo\n domain: googleapis.com\n metadata:\n customConstraints: customConstraints/custom.allowClusterCreateIfAnnotationPresent\n service: gkemulticloud.googleapis.com\n reason: CUSTOM_ORG_POLICY_VIOLATION"]]
