[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[],[],null,["# Set up cross-project references\n===============================\n\n| **Note:** This guide only supports Cloud Service Mesh with Google Cloud APIs and does not support Istio APIs. For more information see, [Cloud Service Mesh overview](/service-mesh/docs/overview).\n\nThis document applies only to Cloud Service Mesh with the Google Cloud\nservice routing APIs. Don't use this document if you are configuring\nCloud Service Mesh with the Istio APIs.\n\nIn some scenarios, the service mesh configuration includes services that\nare in different projects. For example, in Shared VPC or peered VPC\ndeployments it is possible for each project owner to define their own set\nof services to make these services available to all other projects.\n[](/static/service-mesh/docs/images/cross-ref-setup.svg) Cross-project configuration with `Mesh` resources (click to enlarge)\n\nThis configuration is called a *cross-project* configuration because\nmultiple resources defined in different projects are combined to form a\nsingle configuration that can be served to an Envoy proxy or proxyless gRPC\nclient.\n\nThe following instructions use the `Mesh` and `HTTPRoute` resources, but they\ncan be applied to the `Gateway` resource and to the\n`GRPCRoute` and `TCPRoute` resources.\n\nConfigure the `Mesh` resource\n-----------------------------\n\nDesignate a project as the host project where you administer the\n`Mesh` resource. Any service account with the permissions to create,\nupdate, or delete `Mesh` resources in this project can control the routing\nconfigurations attached to `Mesh` resources in this project.\n\n1. In the file `shared-mesh.yaml`, create a `Mesh` specification.\n\n ```\n name: shared-mesh\n interceptionPort: 15001\n ```\n2. Define a `Mesh` resource in this project.\n\n ```\n gcloud network-services meshes import shared-mesh \\\n --source=shared-mesh.yaml \\\n --location=global\n ```\n3. Write down the full URI of the `Mesh` resource, because service owners\n need the URI to attach their routes to this `Mesh`.\n\n ```\n /projects/HOST_PROJECT_NUMBER/locations/global/meshes/shared-mesh\n ```\n4. Grant the `networkservices.meshes.use` IAM permission for this `Mesh`\n to the cross-project service accounts that should be able to attach their\n services information to this `Mesh`.\n\n ```\n gcloud projects add-iam-policy-binding HOST_PROJECT_NUMBER\n --member='HTTP_ROUTE_SERVICE_OWNER_ACCOUNT'\n --role='roles/compute.networkAdmin'\n ```\n\nAll service owners that have`networkservices.meshes.use`\npermission granted to them are able to add their routing rules to this `Mesh`\nresource.\n\nSet up routing in the service projects\n--------------------------------------\n\nEach service owner needs to create one or more backend service and `Route`\nresources in their project, similar to the example in the\n[sidecar proxy configuration guide](/service-mesh/docs/service-routing/set-up-envoy-http-mesh).\nThe only difference is that each `HTTPRoute`, `GRPCRoute`, or `TCPRoute`\nresource must have the URI of the host project's `Mesh` resource in the `meshes`\nfield.\n\n1. Use the following to populate the `meshes` field. You can use either the\n project ID or the project number.\n\n ```\n echo \"name: sharedvpc-http-route\n hostnames:\n - helloworld-gce\n meshes:\n - /projects/HOST_PROJECT_NUMBER/locations/global/meshes/shared-mesh\n rules:\n - action:\n destinations:\n - serviceName: \\\"url/of/the/service\\\"\" | \\\n gcloud network-services http-routes import sharedvpc-http-route \\\n --source=- \\\n --location=global\n ```\n\nCreate the client services in the service projects\n--------------------------------------------------\n\nWhen you configure a Cloud Service Mesh client that is located in a service\nproject, the bootstrap configuration must specify the project number where the\n`Mesh` resource is located and the `Mesh` name. This requirement applies to both\n[Envoy proxy](/service-mesh/docs/service-routing/set-up-envoy-http-mesh#client) and\n[proxyless gRPC deployments](/service-mesh/docs/service-routing/set-up-proxyless-mesh#set-up-bootstrap).\nWith Envoy deployments, use the `--service-proxy:project-number` option.\n\nWhat's next\n-----------\n\n- For information about listing route resources associated with a `Mesh` or `Gateway` resource, see [List `Route` resources](/service-mesh/docs/service-routing/list-route-resources)."]]
