Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Men-deploy instance layanan terkelola menggunakan kebijakan
koneksi layanan
Halaman ini menjelaskan cara administrator instance layanan dapat men-deploy instance
layanan terkelola dan mengonfigurasi konektivitas menggunakan kebijakan
koneksi layanan.
Sebelum memulai
Pastikan layanan terkelola yang ingin di-deploy mendukung
kebijakan koneksi layanan. Membuat layanan tersedia untuk deployment dengan
menggunakan peta koneksi layanan yang tersedia di Pratinjau terbatas. Untuk informasi
lebih lanjut terkait layanan yang mendukung peta koneksi layanan, lihat
Layanan yang didukung.
Anda memerlukan kebijakan koneksi layanan
untuk jaringan VPC, region, dan layanan terkelola yang ingin
di-deploy.
Peran yang diperlukan
Administrator instance layanan tidak memerlukan izin IAM apa pun
untuk jaringan VPC karena izin ini sudah didelegasikan
oleh kebijakan koneksi layanan. Namun izin IAM mungkin
dibutuhkan untuk layanan terkelola tertentu yang di-deploy menggunakan kebijakan
koneksi layanan. Untuk informasi lebih lanjut terkait izin IAM yang
dibutuhkan oleh layanan terkelola tertentu, lihat dokumentasi layanan tersebut.
Men-deploy instance layanan terkelola dan mengonfigurasi konektivitas
Jika ada kebijakan koneksi layanan untuk layanan, administrator layanan konsumen dapat mengonfigurasi konektivitas untuk instance layanan terkelola yang di-deploy secara langsung melalui API atau UI administratif layanan terkelola.
Untuk men-deploy konektivitas layanan terkelola, ikuti langkah berikut. Langkah berikut mungkin
bervariasi tergantung pada layanan terkelola itu sendiri.
Gunakan API atau UI administratif layanan terkelola untuk men-deploy instance
layanan, dengan menentukan Private Service Connect sebagai jenis
konektivitas Anda. Layanan tersebut mungkin menyediakan opsi untuk menentukan
jaringan VPC untuk men-deploy tempat endpoint Private Service Connect.
Apabila lolos semua pemeriksaan perizinan,
konektivitas akan di-deploy. Akun
Layanan Konektivitas Jaringan membuat alamat
IP internal dan endpoint
Private Service Connect di jaringan VPC yang ditentukan.
Siklus proses endpoint cocok dengan siklus proses instance
layanan terkelola. Endpoint akan tetap aktif dan stabil kecuali
apabila Anda mengonfigurasi ulang konektivitas atau menghapus instance layanan
Setelah Akun Layanan Konektivitas Jaringan membuat endpoint, aturan penerusan endpoint akan terlihat di project yang Anda konfigurasi pada langkah 1. Aturan penerusan ini menunjukkan bahwa koneksi telah
diterima oleh produsen dan termasuk alamat IP yang telah ditetapkan pada
endpoint.
Semua nama aturan penerusan yang dibuat menggunakan
kebijakan koneksi layanan dimulai dengan sca-auto-. Berikut adalah
contoh aturan penerusan yang dibuat menggunakan kebijakan koneksi
layanan.
Layanan tersebut mungkin memberikan informasi terkait cara untuk terhubung ke
endpoint baru—contohnya, dengan menyediakan alamat IP. Gunakan
alamat IP yang disediakan untuk berkomunikasi dengan layanan Anda melalui alamat IP
internal dalam Google Cloud.
Untuk informasi lebih lanjut terkait cara mengonfigurasi layanan tertentu, lihat
dokumentasi layanan.
Penghapusan konektivitas layanan
Untuk menghapus konektivitas layanan atau instance layanan terkelola
yang di-deploy menggunakan kebijakan koneksi layanan, gunakan API atau UI
administratif layanan terkelola. Hapus setiap instance layanan yang terkait
dengan layanan terkelola. Saat instance layanan dihapus, otomatisasi konektivitas layanan akan menghapus endpoint dan koneksi yang terkait.
Pemecahan masalah
Bagian ini berisi informasi tentang pemecahan masalah koneksi yang
dibuat melalui otomatisasi konektivitas layanan.
Kegagalan pembuatan atau penghapusan endpoint
Jika endpoint yang diizinkan tidak dibuat atau dihapus seperti yang Anda harapkan,
jelaskan kebijakan koneksi layanan.
Kolom pscConnections berisi detail tentang error pemblokiran dan cara mengatasinya.
Setelah masalah diselesaikan, endpoint akan dibuat atau dihapus saat berikutnya
otomatisasi konektivitas layanan otomatis
mencoba ulang operasi.
Atau, jika tidak ingin menunggu proses percobaan ulang, Anda dapat menggunakan
API atau UI administratif layanan terkelola yang Anda deploy untuk meminta
deployment dan konektivitas untuk instance layanan lain, menggunakan konfigurasi
yang valid.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[],[],null,["# Deploy a managed service instance by using service connection policies\n\nDeploy a managed service instance by using service\nconnection policies\n======================================================================\n\nThis page describes how a service instance administrator can deploy an instance\nof a managed service and configure connectivity by using service connection\npolicies.\n\nBefore you begin\n----------------\n\n- Make sure that the managed service that you want to deploy supports\n service connection policies. Making services available for deployment by\n using service connection maps is available in a limited Preview. For more\n information about services that support service connection maps, see\n [Supported services](/vpc/docs/about-service-connectivity-automation#supported-services).\n\n- You need a [service connection policy](/vpc/docs/about-service-connection-policies)\n for the VPC network, region, and managed service that you want\n to deploy.\n\n### Required roles\n\nService instance administrators don't need any IAM permissions\nfor the VPC network because these permissions are delegated\nby the service connection policy. However, IAM permissions might\nbe required for specific managed services that are deployed by using service\nconnection policies. For information about IAM permissions that\nare required by a specific managed service, check the service's documentation.\n\nDeploy a managed service instance and configure connectivity\n------------------------------------------------------------\n\nIf a service connection policy exists for a service, a consumer service\nadministrator can configure connectivity for the managed service instance that\nthey are deploying directly through the administrative API or UI of the managed\nservice.\n\nTo deploy managed service connectivity, follow these steps. The steps might\nvary depending on the managed service.\n\n1. Use the administrative API or UI of the managed service to deploy a service\n instance, specifying Private Service Connect as your connectivity\n type. The service might provide the option to specify the VPC\n network to deploy Private Service Connect endpoints in.\n\n For example, you can\n [deploy and configure connectivity for a Cloud SQL instance](/sql/docs/mysql/configure-private-service-connect#create-cloud-sql-instance-psc-enabled-2).\n | **Note:** A service connection policy must exist for this VPC network, region, and service class. Otherwise, the service producer that's represented by the service class is not authorized to deploy connectivity on your behalf.\n2. If all [authorization checks](/vpc/docs/about-service-connectivity-automation#authorization)\n pass, then connectivity is deployed. The\n Network Connectivity Service Account creates an internal IP\n address and Private Service Connect\n endpoint in the specified VPC network.\n\n The lifecycle of your endpoint matches the lifecycle of your managed\n service instance. The endpoint remains active and stable unless you\n reconfigure connectivity or [decommission the service instance](#decommission-service)\n3. After the Network Connectivity Service Account creates your endpoint, the\n endpoint's forwarding rule is visible in the project that you configured\n in step 1. This forwarding rule indicates that the connection has been\n accepted by the producer and includes the IP address that was assigned to\n your endpoint.\n\n The names of all forwarding rules that are created by using\n service connection policies start with `sca-auto-`. The following is an\n example of a forwarding rule that was created by using a service connection\n policy. \n\n ```\n\n kind: compute#forwardingRule\n name: sca-auto-ab3f45d\n IPAddress: 10.33.2.8\n allowPscGlobalAccess: true\n network: https://www.googleapis.com/compute/v1/projects/consumer-project/global/networks/vpc1\n pscConnectionStatus: ACCEPTED\n region: https://www.googleapis.com/compute/v1/projects/consumer-project/regions/us-central1\n selfLink: https://www.googleapis.com/compute/v1/projects/consumer-project/regions/us-central1/forwardingRules/sca-auto-ab3f45d\n serviceDirectoryRegistrations:\n -namespace: goog-psc-default\n target:\n https://www.googleapis.com/compute/v1/projects/producer-project/regions/us-central1/serviceAttachments/producer-sa\n\n ```\n4. Your service might provide information about how to connect to the\n new endpoint---for example, by providing an IP address. Use the\n provided IP address to communicate with your service through internal IP\n addresses within Google Cloud.\n\n For more information about how to configure a specific service, see that\n service's documentation.\n\n| **Caution:** The managed service fully controls the lifecycle of Private Service Connect endpoints and IP addresses that are deployed by using service connection policies. Don't directly delete or update these Google Cloud resources or else you risk losing connectivity to your managed service instance. All actions to add, remove, or update connectivity for a managed service instance should be taken directly through the administrative API or UI of the managed service.\n\nDecommission service connectivity\n---------------------------------\n\nTo decommission service connectivity or decommission a managed service instance\nthat's deployed by using service connection policies, use the administrative API\nor UI of the managed service. Delete each service instance that's associated\nwith the managed service. When service instances are deleted, service\nconnectivity automation deletes the associated connections and endpoints.\n\nTroubleshooting\n---------------\n\nThis section contains information about troubleshooting connections that are\ncreated through service connectivity automation.\n\n### Endpoint creation or deletion failure\n\nIf authorized endpoints are not created or deleted as you expect,\n[describe the service connection policy](/vpc/docs/configure-service-connection-policies#describe-policy).\nThe `pscConnections` field contains details about any blocking\nerrors and how you can resolve them.\n\nAfter any issues are resolved, the endpoint is created or deleted the next time\nservice connectivity automation automatically\n[retries the operation](/vpc/docs/about-service-connectivity-automation#endpoint-automation).\n\nAlternatively, if you don't want to wait for the retry process, you can use the\nadministrative API or UI of the managed service you are deploying to request\ndeployment and connectivity for another service instance, using a valid\nconfiguration."]]
