App Engine na iya isa ga bayanan VPN ɗinku: abin da dole ya daidaita

Maganar cewa App Engine Standard ba zai iya isa ga bayanan sirri ta hanyar Cloud VPN ba, ragowar ƙarni ne na farko na dandalin. Standard instances ba sa samun adireshin VPC na asali kamar yadda wasu runtime ɗin ke samu, amma suna iya aika fitarwa ta hanyar Serverless VPC Access connector da ke cikin cibiyar sadarwarku. Da zarar wannan hanyar ta kasance, Cloud VPN da firewall na nesa suna ganin zirga-zirgar connector kamar kowace tushe. Abin da ke kasawa ba safai ba ita ce ikon kanta. Ɗaya ne daga cikin saitunan uku da ba a taɓa daidaita su ba.

Daga inda tsohuwar amsar ta zo

Kafin connectors su kasance, amsar da ta dace a zahiri ita ce Standard zai iya magana da ƙarshen wuraren jama'a kawai, kuma ƙungiyoyi sun ƙaura zuwa proxy VM ko wani runtime don guje wa hakan. Dandalin ya canza, tatsuniya ba ta canza ba. Yawancin shawarwari a kan layi har yanzu suna nuna zamanin da babu wani zaɓi na fitarwa kwata-kwata.

Gyaran ya fi ƙunci fiye da yadda ake ji. Standard na iya isa ga cibiyar sadarwar sirri, amma ta hanyar haɗin fitarwa da aka goyi bayan kawai, kuma ga wuraren da wannan haɗin ke kamawa kawai.

Zaɓi hanyar fitarwa da farko

Connector da ke manne da sabis shine yake sanya zirga-zirgarsa cikin VPC. Takardun connector suna lissafin sharadi na yanki da saitunan fitarwa; connector dole ne ya kasance a yankin sabis kuma mai yin turawa zai iya amfani da shi.

vpc_access_connector:
  name: projects/PROJECT_ID/locations/REGION/connectors/CONNECTOR_NAME
  egress_setting: private-ranges-only

private-ranges-only yana aika wuraren sirri cikin VPC kuma yana barin komai a kan hanyar intanet ta yau da kullum, wanda yawanci shine abin da haɗin bayanai ke buƙata. all-traffic yana tura zirga-zirgar fita ta VPC gaba ɗaya, don haka kiran intanet na yau da kullum ma suna gado NAT da yanayin firewall na VPC.

Gyara fayil ɗin a gida ba ya canza komai har sai kun tura. Sigar da ke gudana tana riƙe da tsarin da aka ƙirƙira ta da shi.

Adireshin tushe shine connector, ba kwamfutar tafi-da-gidanka ba

Anan ne yawancin lokacin gyara ke tafiya. Ƙofar VPN ta nesa da firewall na bayanai dole ne su karɓi kewayon da aka keɓe wa connector cikin VPC, ba adireshin ofishinku ba kuma ba adireshin fitarwa na jama'a na sabis ɗin ba. Nemo wannan kewayon a cikin console kafin rubuta ko ɗaya doka.

Wurare biyu kuma dole su yarda. Teburin hanyoyin VPC yana buƙatar hanya zuwa cibiyar sadarwar bayanan nesa, kuma ɓangaren nesa yana buƙatar hanyar dawowa don kewayon connector. Idan tunnel ɗin yana amfani da masu zaɓen zirga-zirga, tabbatar cewa kewayon connector yana cikin iyakar da aka tattauna. Hanya da ke kasancewa kawai a alkiblar daga nesa zuwa gida kuskure ne na kowa, kuma yana barin pings su wuce ba tare da kammala musafaha TCP ba.

Tunnel da ke karɓar kawai subnet VM zai jefar da fakitin connector ba tare da saƙon kuskure mai amfani ba, wanda shine dalilin da yasa lokacin ƙarewar bayanai ke kama da matsalar shaidar shiga.

DNS yana tafiya ta wata hanya

Sunan mahalli na bayanan sirri dole ne a warware shi cikin cibiyar sadarwar da connector ke isa, ta hanyar Cloud DNS peering ko yankin turawa da VPC zai iya amfani da shi. Warware shi a kan aikin aikinku ba ya tabbatar da komai game da sabis ɗin da aka tura, domin kwamfutar tafi-da-gidanku ba ta amfani da wannan mai warwarewa.

Idan sunan ya warware zuwa adireshin jama'a daga cikin VPC, kuna gab da gyara firewall mara daidai.

URL Fetch ba ya amfani da connector

Saitin fitarwa yana rufe soket ɗin fita na yau da kullum na runtime, kuma tsohon sabis ɗin URL Fetch baya cikin wannan hanyar. Buƙatar da aka bayar ta urlfetch tana watsi da connector komai tsarin ya ce. Lokacin da kiran da ya kasa yana cikin tsohon ɗakin karatu da har yanzu ke amfani da URL Fetch, maganin shine matsar da wannan kiran zuwa daidaitaccen abokin ciniki na HTTP.

Ga direban bayanai wannan ba safai ba ne matsalar, amma shine sanannen dalilin da yasa ƙarshen wuri ɗaya ke aiki ɗayan kuma ba ya aiki daga wannan sabis ɗin.

Tabbatar da bincike guda ɗaya mai ƙunci

Tura, sannan gudanar da aikin bayanai guda ɗaya da aka halatta daga sigar da aka tura yayin kallon ɓangaren nesa. Adireshin tushe da bayanai ko ƙofar VPN suka rubuta ya kamata ya zama na connector. Idan ba haka ba, buƙatar ba ta taɓa shiga VPC ba kuma babu adadin tsarin tunnel da zai gyara shi. Kwatanta shi da kewayon da kuka nemo a console; rashin daidaituwa yawanci yana nufin wani connector na biyu yana hidimar sigar.

Bincike mai nasara daga VM cikin VPC yana tabbatar da cewa hanya tana nan. Ba ya tabbatar da cewa sabis ɗin ya zaɓe ta.