Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Configurar serviços TCP
Neste guia, mostramos como configurar o Cloud Service Mesh para usar serviços TCP
e recursos TCPRoute.
O Cloud Service Mesh com serviços TCP e TCPRoute é semelhante à
configuração do proxy sidecar do Envoy com serviços HTTP. As exceções são que
o serviço de back-end fornece um serviço TCP e o roteamento é baseado em parâmetros TCP/IP
em vez do protocolo HTTP.
Mesh recurso comTCPRoute recurso (clique para ampliar)
Esta parte do guia não é específica das novas APIs e usa recursos atuais de serviço de back-end, verificação de integridade e MIG.
Para fins de demonstração, crie um serviço de back-end com VMs com escalonamento automático usando grupos de instâncias gerenciadas que atendam a um serviço TCP de teste na porta 10000.
Crie um modelo de instância de VM do Compute Engine com um serviço de teste na porta 10000.
Crie um serviço de back-end global
com um esquema de balanceamento de carga de INTERNAL_SELF_MANAGED e anexe a
verificação de integridade ao serviço de back-end. No exemplo, usamos o grupo de instâncias gerenciadas
que executa o serviço TCP de amostra criado anteriormente.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-19 UTC."],[],[],null,["# Set up TCP services\n===================\n\n| **Note:** This guide only supports Cloud Service Mesh with Google Cloud APIs and does not support Istio APIs. For more information see, [Cloud Service Mesh overview](/service-mesh/docs/overview).\n\nThis guide tells you how to set up Cloud Service Mesh to use TCP services\nand `TCPRoute` resources.\n\nCloud Service Mesh with TCP services and `TCPRoute` is similar to the\nEnvoy sidecar proxy configuration with HTTP services. The exceptions are that\nthe backend service provides a TCP service and routing is based on TCP/IP\nparameters rather than on the HTTP protocol.\n[](/static/service-mesh/docs/images/mesh-tcp.svg) `Mesh` resource with `TCPRoute` resource (click to enlarge)\n\nBefore you begin\n----------------\n\nMake sure that you complete the tasks described in\n[Prepare to set up with Envoy and proxyless workloads](/service-mesh/docs/onboarding/prepare-service-routing-envoy-proxyless).\n\nConfigure the `Mesh` resource\n-----------------------------\n\n1. In a file called `mesh.yaml`, create the `mesh` resource specification.\n\n ```\n name: sidecar-mesh\n ```\n2. Use the `mesh.yaml` file to create the `mesh` resource.\n\n ```\n gcloud network-services meshes import sidecar-mesh \\\n --source=mesh.yaml \\\n --location=global\n ```\n\nConfigure the TCP server\n------------------------\n\nThis part of the guide is not specific to the new APIs and uses existing\nbackend service, health check, and MIG resources.\n\nFor demonstration purposes, you create a backend service with autoscaled VMs\nusing [managed instance groups](/compute/docs/instance-groups#managed_instance_groups)\nthat serve a test TCP service on port `10000`.\n\n1. Create a Compute Engine VM instance template with a test\n service on port `10000`.\n\n ```\n gcloud compute instance-templates create tcp-td-vm-template \\\n --scopes=https://www.googleapis.com/auth/cloud-platform \\\n --tags=allow-health-checks \\\n --image-family=debian-10 \\\n --image-project=debian-cloud \\\n --metadata=startup-script=\"#! /bin/bash\n sudo apt-get update -y\n sudo apt-get install netcat -y\n while true;\n do echo 'Hello from TCP service' | nc -l -s 0.0.0.0 -p 10000;\n done &\"\n ```\n2. Create a managed instance group based on the template.\n\n ```\n gcloud compute instance-groups managed create tcp-td-mig-us-east1 \\\n --zone=ZONE \\\n --size=1 \\\n --template=tcp-td-vm-template\n ```\n3. Set the named ports on the created managed instance group to port 10000.\n\n ```\n gcloud compute instance-groups set-named-ports tcp-td-mig-us-east1 \n\n --zone=ZONE \n\n --named-ports=tcp:10000\n ```\n\n \u003cbr /\u003e\n\n4. Create a health check.\n\n ```\n gcloud compute health-checks create tcp tcp-helloworld-health-check --port 10000\n ```\n5. Create a firewall rule to allow incoming health check connections to\n instances in your network.\n\n ```\n gcloud compute firewall-rules create tcp-vm-allow-health-checks \\\n --network default \\\n --action allow \\\n --direction INGRESS \\\n --source-ranges=35.191.0.0/16,130.211.0.0/22 \\\n --target-tags allow-health-checks \\\n --rules tcp:10000\n ```\n6. Create a [global backend service](/load-balancing/docs/backend-service)\n with a load balancing scheme of `INTERNAL_SELF_MANAGED` and attach the\n health check to the backend service. The example uses the managed instance\n group that runs the sample TCP service that you created earlier.\n\n ```\n gcloud compute backend-services create tcp-helloworld-service \\\n --global \\\n --load-balancing-scheme=INTERNAL_SELF_MANAGED \\\n --protocol=TCP \\\n --health-checks tcp-helloworld-health-check\n ```\n7. Add the managed instance group to the backend service.\n\n ```\n gcloud compute backend-services add-backend tcp-helloworld-service \\\n --instance-group tcp-td-mig-us-east1 \\\n --instance-group-zone=ZONE \\\n --global\n ```\n\nSet up routing with `TCPRoute`\n------------------------------\n\nIn this section, you set up routing.\n\n1. In a file called `tcp_route.yaml`, create the `TcpRoute` specification.\n\n You can use either `$PROJECT_ID` or `$PROJECT_NUMBER`. \n\n ```\n name: helloworld-tcp-route\n meshes:\n - projects/$PROJECT_NUMBER/locations/global/meshes/sidecar-mesh\n rules:\n - action:\n destinations:\n - serviceName: projects/$PROJECT_NUMBER/locations/global/backendServices/tcp-helloworld-service\n matches:\n - address: '10.0.0.1/32'\n port: '10000'\n ```\n2. Using the `tcp_route.yaml` specification, create the `TcpRoute` resource.\n\n ```\n gcloud network-services tcp-routes import helloworld-tcp-route \\\n --source=tcp-route.yaml \\\n --location=global\n ```\n\nCreate a TCP client with an Envoy sidecar\n-----------------------------------------\n\n1. Create an instance template and then create a VM with Envoy that is\n connected to Cloud Service Mesh.\n\n ```\n gcloud beta compute instance-templates create td-vm-client-template \\\n --image-family=debian-10 \\\n --image-project=debian-cloud \\\n --service-proxy=enabled,mesh=sidecar-mesh \\\n --metadata=startup-script=\"#! /bin/bash\n sudo apt-get update -y\n sudo apt-get install netcat -y\"\n ``` \n\n ```\n gcloud compute instances create td-vm-client \\\n --zone=ZONE \\\n --source-instance-template td-vm-client-template\n ```\n2. Sign in to the VM that you created.\n\n ```\n gcloud compute ssh td-vm-client\n ```\n3. Verify connectivity to the test services that you created using the `netcat`\n utility.\n\n ```\n echo 'Hi TCP Service' | nc 10.0.0.1 10000\n ```\n\nThe test service should return the phrase **Hello from TCP\nservice** . You should also be able to see any text that you type\nreturned by the `netcat` service running on the remote VM.\n\nLimitations\n-----------\n\nYou cannot configure a Google Cloud Armor security policy if you are using\nTCP traffic routing.\n\nWhat's next\n-----------\n\n- [List `Route` resources](/service-mesh/docs/service-routing/list-route-resources)"]]
