Cloud Service Mesh dan Traffic Director kini bergabung menjadi Cloud Service Mesh. Untuk mengetahui informasi selengkapnya, lihat ringkasan Cloud Service Mesh.
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Menambahkan layanan Cloud Service Mesh (Dalam cluster) ke
perimeter layanan
Jika telah membuat
perimeter layanan di
organisasi, Anda harus menambahkan
Certificate Authority
(Certificate Authority Service atau Certificate Authority Cloud Service Mesh), Konfigurasi Mesh,
logging Stackdriver, Cloud Monitoring, dan layanan Cloud Trace ke
perimeter, dalam kasus berikut:
Cluster tempat Anda menginstal Cloud Service Mesh berada dalam project
yang disertakan dalam perimeter layanan.
Cluster tempat Anda menginstal Cloud Service Mesh adalah project layanan dalam jaringan VPC Bersama.
Dengan menambahkan layanan ini ke perimeter layanan, cluster Cloud Service Mesh Anda dapat mengakses layanan ini. Akses ke layanan juga dibatasi dalam jaringan Virtual Private Cloud (VPC) cluster Anda.
Tidak menambahkan layanan yang disebutkan di atas dapat menyebabkan penginstalan Cloud Service Mesh gagal atau menyebabkan fungsi tidak ada. Misalnya, jika Anda tidak
menambahkan otoritas sertifikasi Cloud Service Mesh ke perimeter layanan, beban kerja tidak dapat mendapatkan
sertifikat dari otoritas sertifikasi Cloud Service Mesh.
Di halaman Edit VPC Service Perimeter, klik Add Services di bagian Services to
protect.
Pada dialog Tentukan layanan untuk dibatasi, klik Filter
layanan. Bergantung pada Certificate Authority (CA) Anda, masukkan
Cloud Service Mesh Certificate Authority API atau
Certificate Authority Service API.
Pilih kotak centang layanan.
Klik Tambahkan Cloud Service Mesh Certificate Authority API.
Ulangi langkah 2 - 5, untuk menambahkan:
Mesh Configuration API
Cloud Monitoring API
Cloud Trace API
Klik Simpan.
gcloud
Untuk memperbarui daftar layanan yang dibatasi, gunakan perintah update dan
tentukan layanan yang akan ditambahkan sebagai daftar yang dipisahkan koma:
PERIMETER_NAME adalah nama perimeter layanan yang ingin Anda
perbarui.
OTHER_SERVICES adalah daftar opsional yang dipisahkan koma
dari satu atau beberapa layanan yang akan disertakan dalam perimeter selain
layanan yang diisi dalam perintah sebelumnya. Contoh: storage.googleapis.com,bigquery.googleapis.com.
POLICY_NAME adalah nama numerik kebijakan akses
organisasi Anda. Contoh, 330193482019.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[],[],null,["# Adding Cloud Service Mesh (In-cluster) services to the service perimeters\n\nAdding Cloud Service Mesh (In-cluster) services to the\nservice perimeters\n=========================================================================\n\n| **Note:** This guide only supports Cloud Service Mesh with Istio APIs and does not support Google Cloud APIs. For more information see, [Cloud Service Mesh overview](/service-mesh/docs/overview).\n\nIf you have created a\n[service perimeter](/vpc-service-controls/docs/service-perimeters) in your\norganization, you must add the\n[Certificate Authority](/service-mesh/docs/unified-install/plan-install#choose_a_certificate_authority)\n(Cloud Service Mesh certificate authority or Certificate Authority Service), Mesh Configuration,\nStackdriver logging, Cloud Monitoring, and Cloud Trace services to the\nperimeter, in the following cases:\n\n- The cluster on which you have installed Cloud Service Mesh is in a project that is included in a service perimeter.\n- The cluster on which you have installed Cloud Service Mesh is a *service project* in a [Shared VPC network](/vpc/docs/shared-vpc).\n\nBy adding these services to the service perimeter, your Cloud Service Mesh\ncluster can access these services. Access to the services is also restricted\nwithin your cluster's Virtual Private Cloud (VPC) network.\n\nNot adding the aforementioned services may cause the Cloud Service Mesh\ninstallation to fail or cause functions to be missing. For example, if you don't\nadd Cloud Service Mesh certificate authority to the service perimeter, the workloads can not get\ncertificates from the Cloud Service Mesh certificate authority.\n\nBefore you begin\n----------------\n\nThe setup for the VPC Service Controls service perimeter is at the\n[organization level](/resource-manager/docs/cloud-platform-resource-hierarchy).\nEnsure that you have been granted the\n[proper roles for administering VPC Service Controls](/vpc-service-controls/docs/access-control).\nIf you have multiple projects, you can apply the service perimeter to all of\nthe projects by\n[adding each project to the service perimeter](/vpc-service-controls/docs/manage-service-perimeters#update).\n\nAdding Cloud Service Mesh services to an existing service perimeter\n-------------------------------------------------------------------\n\n### Console\n\n1. Follow the steps in [Updating a service perimeter](/vpc-service-controls/docs/manage-service-perimeters#update) to edit the perimeter.\n2. On the **Edit VPC Service Perimeter** page, under **Services to\n protect** , click **Add Services**.\n3. On the **Specify services to restrict** dialog, click **Filter\n services** . Depending on your Certificate Authority (CA), enter either **Cloud Service Mesh Certificate Authority API** or **Certificate Authority Service API**.\n4. Select the service's checkbox.\n5. Click **Add Cloud Service Mesh Certificate Authority API**.\n6. Repeat steps 2 - 5, to add:\n - **Mesh Configuration API**\n - **Cloud Monitoring API**\n - **Cloud Trace API**\n7. Click **Save**.\n\n### gcloud\n\nTo update the list of restricted services, use the `update` command and\nspecify the services to add as a comma-delimited list:\n**Note:** If your service mesh uses Certificate Authority Service, then replace `meshca.googleapis.com` with `privateca.googleapis.com` in the following command. \n\n```bash\ngcloud access-context-manager perimeters update PERIMETER_NAME \\\n --add-restricted-services=meshconfig.googleapis.com,meshca.googleapis.com,monitoring.googleapis.com,cloudtrace.googleapis.com,OTHER_SERVICES \\\n --policy=POLICY_NAME\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e is the name of the service perimeter that you\n want to update.\n\n- \u003cvar translate=\"no\"\u003eOTHER_SERVICES\u003c/var\u003e is an optional comma-separated list\n of one or more services to include in the perimeter in addition to the\n services populated in the preceding command. For example:\n `storage.googleapis.com,bigquery.googleapis.com`.\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the numeric name of your organization's access\n policy. For example, `330193482019`.\n\nRefer to\n[Updating a service perimeter](/vpc-service-controls/docs/manage-service-perimeters#update)\nfor additional information."]]
