Cloud Service Mesh dan Traffic Director kini bergabung menjadi Cloud Service Mesh. Untuk mengetahui informasi selengkapnya, lihat ringkasan Cloud Service Mesh.
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Menyiapkan layanan TCP
Panduan ini menjelaskan cara menyiapkan Cloud Service Mesh untuk menggunakan layanan TCP dan resource TCPRoute.
Cloud Service Mesh dengan layanan TCP dan TCPRoute mirip dengan konfigurasi proxy sidecar Envoy dengan layanan HTTP. Pengecualiannya adalah layanan backend menyediakan layanan TCP dan perutean didasarkan pada parameter TCP/IP, bukan pada protokol HTTP.
Resource Mesh dengan resource TCPRoute (klik untuk memperbesar)
Bagian panduan ini tidak khusus untuk API baru dan menggunakan layanan backend, health check, dan resource MIG yang ada.
Untuk tujuan demonstrasi, Anda membuat layanan backend dengan VM yang diskalakan otomatis menggunakan grup instance terkelola yang melayani layanan TCP pengujian di port 10000.
Buat template instance VM Compute Engine dengan layanan
pengujian di port 10000.
Buat layanan backend global
dengan skema load balancing INTERNAL_SELF_MANAGED dan lampirkan
health check ke layanan backend. Contoh ini menggunakan grup instance terkelola yang menjalankan layanan TCP contoh yang Anda buat sebelumnya.
Verifikasi konektivitas ke layanan pengujian yang Anda buat menggunakan utilitas netcat.
echo 'Hi TCP Service' | nc 10.0.0.1 10000
Layanan pengujian akan menampilkan frasa Hello from TCP
service. Anda juga akan dapat melihat teks apa pun yang Anda ketik
yang ditampilkan oleh layanan netcat yang berjalan di VM jarak jauh.
Batasan
Anda tidak dapat mengonfigurasi kebijakan keamanan Google Cloud Armor jika menggunakan
perutean traffic TCP.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[],[],null,["# Set up TCP services\n===================\n\n| **Note:** This guide only supports Cloud Service Mesh with Google Cloud APIs and does not support Istio APIs. For more information see, [Cloud Service Mesh overview](/service-mesh/docs/overview).\n\nThis guide tells you how to set up Cloud Service Mesh to use TCP services\nand `TCPRoute` resources.\n\nCloud Service Mesh with TCP services and `TCPRoute` is similar to the\nEnvoy sidecar proxy configuration with HTTP services. The exceptions are that\nthe backend service provides a TCP service and routing is based on TCP/IP\nparameters rather than on the HTTP protocol.\n[](/static/service-mesh/docs/images/mesh-tcp.svg) `Mesh` resource with `TCPRoute` resource (click to enlarge)\n\nBefore you begin\n----------------\n\nMake sure that you complete the tasks described in\n[Prepare to set up with Envoy and proxyless workloads](/service-mesh/docs/onboarding/prepare-service-routing-envoy-proxyless).\n\nConfigure the `Mesh` resource\n-----------------------------\n\n1. In a file called `mesh.yaml`, create the `mesh` resource specification.\n\n ```\n name: sidecar-mesh\n ```\n2. Use the `mesh.yaml` file to create the `mesh` resource.\n\n ```\n gcloud network-services meshes import sidecar-mesh \\\n --source=mesh.yaml \\\n --location=global\n ```\n\nConfigure the TCP server\n------------------------\n\nThis part of the guide is not specific to the new APIs and uses existing\nbackend service, health check, and MIG resources.\n\nFor demonstration purposes, you create a backend service with autoscaled VMs\nusing [managed instance groups](/compute/docs/instance-groups#managed_instance_groups)\nthat serve a test TCP service on port `10000`.\n\n1. Create a Compute Engine VM instance template with a test\n service on port `10000`.\n\n ```\n gcloud compute instance-templates create tcp-td-vm-template \\\n --scopes=https://www.googleapis.com/auth/cloud-platform \\\n --tags=allow-health-checks \\\n --image-family=debian-10 \\\n --image-project=debian-cloud \\\n --metadata=startup-script=\"#! /bin/bash\n sudo apt-get update -y\n sudo apt-get install netcat -y\n while true;\n do echo 'Hello from TCP service' | nc -l -s 0.0.0.0 -p 10000;\n done &\"\n ```\n2. Create a managed instance group based on the template.\n\n ```\n gcloud compute instance-groups managed create tcp-td-mig-us-east1 \\\n --zone=ZONE \\\n --size=1 \\\n --template=tcp-td-vm-template\n ```\n3. Set the named ports on the created managed instance group to port 10000.\n\n ```\n gcloud compute instance-groups set-named-ports tcp-td-mig-us-east1 \n\n --zone=ZONE \n\n --named-ports=tcp:10000\n ```\n\n \u003cbr /\u003e\n\n4. Create a health check.\n\n ```\n gcloud compute health-checks create tcp tcp-helloworld-health-check --port 10000\n ```\n5. Create a firewall rule to allow incoming health check connections to\n instances in your network.\n\n ```\n gcloud compute firewall-rules create tcp-vm-allow-health-checks \\\n --network default \\\n --action allow \\\n --direction INGRESS \\\n --source-ranges=35.191.0.0/16,130.211.0.0/22 \\\n --target-tags allow-health-checks \\\n --rules tcp:10000\n ```\n6. Create a [global backend service](/load-balancing/docs/backend-service)\n with a load balancing scheme of `INTERNAL_SELF_MANAGED` and attach the\n health check to the backend service. The example uses the managed instance\n group that runs the sample TCP service that you created earlier.\n\n ```\n gcloud compute backend-services create tcp-helloworld-service \\\n --global \\\n --load-balancing-scheme=INTERNAL_SELF_MANAGED \\\n --protocol=TCP \\\n --health-checks tcp-helloworld-health-check\n ```\n7. Add the managed instance group to the backend service.\n\n ```\n gcloud compute backend-services add-backend tcp-helloworld-service \\\n --instance-group tcp-td-mig-us-east1 \\\n --instance-group-zone=ZONE \\\n --global\n ```\n\nSet up routing with `TCPRoute`\n------------------------------\n\nIn this section, you set up routing.\n\n1. In a file called `tcp_route.yaml`, create the `TcpRoute` specification.\n\n You can use either `$PROJECT_ID` or `$PROJECT_NUMBER`. \n\n ```\n name: helloworld-tcp-route\n meshes:\n - projects/$PROJECT_NUMBER/locations/global/meshes/sidecar-mesh\n rules:\n - action:\n destinations:\n - serviceName: projects/$PROJECT_NUMBER/locations/global/backendServices/tcp-helloworld-service\n matches:\n - address: '10.0.0.1/32'\n port: '10000'\n ```\n2. Using the `tcp_route.yaml` specification, create the `TcpRoute` resource.\n\n ```\n gcloud network-services tcp-routes import helloworld-tcp-route \\\n --source=tcp-route.yaml \\\n --location=global\n ```\n\nCreate a TCP client with an Envoy sidecar\n-----------------------------------------\n\n1. Create an instance template and then create a VM with Envoy that is\n connected to Cloud Service Mesh.\n\n ```\n gcloud beta compute instance-templates create td-vm-client-template \\\n --image-family=debian-10 \\\n --image-project=debian-cloud \\\n --service-proxy=enabled,mesh=sidecar-mesh \\\n --metadata=startup-script=\"#! /bin/bash\n sudo apt-get update -y\n sudo apt-get install netcat -y\"\n ``` \n\n ```\n gcloud compute instances create td-vm-client \\\n --zone=ZONE \\\n --source-instance-template td-vm-client-template\n ```\n2. Sign in to the VM that you created.\n\n ```\n gcloud compute ssh td-vm-client\n ```\n3. Verify connectivity to the test services that you created using the `netcat`\n utility.\n\n ```\n echo 'Hi TCP Service' | nc 10.0.0.1 10000\n ```\n\nThe test service should return the phrase **Hello from TCP\nservice** . You should also be able to see any text that you type\nreturned by the `netcat` service running on the remote VM.\n\nLimitations\n-----------\n\nYou cannot configure a Google Cloud Armor security policy if you are using\nTCP traffic routing.\n\nWhat's next\n-----------\n\n- [List `Route` resources](/service-mesh/docs/service-routing/list-route-resources)"]]
