App Engine wuu gaari karaa keydkaaga xogta VPN: waxa ay tahay in ay is waafajiyaan

Sheegashada ah in App Engine Standard uusan ku gaari karin keyd xogta gaar ah iyada oo loo marayo Cloud VPN waa hadhaaga jiil hore oo madal ah. Standard instances ma helaan cinwaan VPC u gaar ah sida qaar ka mid ah deegaannada kale ee socodka, laakiin waxay u diri karaan egress iyada oo loo marayo connector Serverless VPC Access oo ku yaal shabkaaga. Marka wadadaasi jirto, Cloud VPN iyo firewall-ka fog waxay u arkaan taraafikada connector sida isha kale. Waxa fashilma marar dhif ah ayaa ah awoodda lafteeda. Waa mid ka mid ah saddexda dejinta oo aan waligood is waafajin.

Jawaabta hore xaggee ka timid

Ka hor intaan connectors jirin, jawaabta wax ku oolka ah runtii waxay ahayd in Standard uu la hadli karo oo kaliya dhammaadka dadweynaha, kooxahuna waxay u guureen proxy VM ama deegaan kale oo socod si ay uga gudbaan taas. Madalku wuu is beddelay, sheeko-dhaqameedka ma uusan is beddelin. Talooyin badan oo online ah ayaa wali ka tarjumaya waagii aan wax ikhtiyaar egress ah jirin.

Sixitaanku wuu ka cidhiidhi yahay sidii loo maqlay. Standard wuu gaari karaa shabka gaar ah, laakiin kaliya iyada oo loo marayo isku-darka egress la taageeray, iyo kaliya meelaha uu isku-darkaasi runtii qabto.

Marka hore dooro wadada egress

Connector ku xiran adeegga ayaa taraafikadiisa geliya VPC. Dukumeentiga connector-ka wuxuu taxayaa shardiga gobolka iyo dejinta egress; connector-ku waa inuu ku jiraa gobolka adeegga oo uu isticmaali karo aqoonsiga geynaya.

vpc_access_connector:
  name: projects/PROJECT_ID/locations/REGION/connectors/CONNECTOR_NAME
  egress_setting: private-ranges-only

private-ranges-only wuxuu u diraa meelaha gaar ah VPC oo wuxuu ku reebaa wax kasta oo kale wadada caadiga ah ee internetka, taas oo inta badan ah waxa xiriirka keydka xogta u baahan yahay. all-traffic wuxuu si ballaaran u riixaa taraafikada baxa VPC dhexdiisa, sidaas darteed wicitaannada internetka caadiga ah waxay sidoo kale dhaxlaan NAT iyo mawqifka firewall ee VPC.

Faylka maxalliga ah wax ka beddeliddiisu waxba ma beddesho ilaa aad geyso. Nooca socda wuxuu hayaa habka loo abuuray.

Cinwaanka isha waa connector-ka, ma aha laptop-kaaga

Halkan ayay waqtiga badankii cilad-baaritaanka ku baxaa. Gateway-ga VPN ee fog iyo firewall-ka keydka xogta waa in ay VPC gudaha ogolaadaan xadka loo qoondeeyay connector-ka, ma aha cinwaanka xafiiskaaga iyo ma aha cinwaanka egress dadweynaha ee adeegga. Raadi xadkaas console-ka ka hor inta aadan qorin hal xeer.

Laba meelood oo kale waa in ay is waafajiyaan. Jadwalka wadooyinka VPC wuxuu u baahan yahay waddo u socota shabka keydka xogta fog, dhinaca fogna wuxuu u baahan yahay waddo soo noqod oo loogu talagalay xadka connector-ka. Haddii tunnel-ku isticmaalo doorashooyinka taraafikada, xaqiiji in xadka connector-ku ku jiro baaxadda laga wada hadlay. Waddo ku jirta oo kaliya jihada fog-ilaa-maxalli waa khalad caadi ah, waxayna dhaafisaa ping laakiin waligeed ma dhammaystirto isku-dhafka TCP.

Tunnel-ku ogolaada kaliya subnet VM wuxuu tuuri doonaa baakadaha connector-ka isagoo aan lahayn fariin khalad faa'iido leh, taasina waa sababta waqtiga keydka xogta uu u eg yahay dhibaatada aqoonsiga.

DNS wuxuu maraa waddo kale

Magaca martigeliyaha keydka xogta gaar ah waa in lagu xalliyaa shabka uu connector-ku gaaro, iyada oo loo marayo Cloud DNS peering ama aag gudbin ah oo VPC ay isticmaali karto. In lagu xalliyo shaqadaada ma caddeynayso wax ku saabsan adeegga la geeyay, sababtoo ah laptop-kaagu ma isticmaalo xaliyahaas.

Haddii magacu ka soo xallimo cinwaan dadweyne VPC gudaha, waxaad ku dhowdahay inaad cilad-baarto firewall khaldan.

URL Fetch ma isticmaalo connector-ka

Dejinta egress waxay daboolaysaa socket-yada baxa ee caadiga ah ee deegaanka socodka, adeegga hore ee URL Fetchna ma aha qayb ka mid ah waddadaas. Codsiga lagu soo saaray urlfetch wuxuu iska indhatiraa connector-ka wax kasta oo habayntu sheegto. Marka wicitaanka fashilma uu ku jiro maktabad hore oo wali isticmaalaysa URL Fetch, xalku waa in wicitaankaas loo raro macmiilka caadiga ah ee HTTP.

Darawal keyd xogta ah tani marar dhif ah ma tahay dhibaatada, laakiin waa sababta caadiga ah ee ay hal dhammaad shaqeeyo mid kalena uusan ka shaqeyn isla adeegga.

Ku xaqiiji hal weydiin cidhiidhi ah

Gee, kadibna ka samee hal hawlgalka keydka xogta oo la oggolaaday nooca la geeyay adigoo daawanaya dhinaca fog. Cinwaanka isha ee keydka xogta ama gateway-ga VPN diiwaangeliyaa waa inuu noqdaa kan connector-ka. Haddii uusan sidaas ahayn, codsiga waligiis ma galin VPC oo ma jiro habayn tunnel oo hagaajin karta. La barbardhig xadka aad console-ka ka raadisey; is-waafajin la'aantu waxay inta badan la macno tahay in connector labaad u adeegayo nooca.

Weydiin guul leh oo laga sameeyay VM ku jira VPC waxay caddeynaysaa in waddadu jirto. Ma caddeyneyso in adeeggu doortay.