Cloud Run iya ku-VPN yasekhaya: ukusetha i-Direct VPC egress

Umhubhe we-Cloud VPN awubeki i-Cloud Run kunethiwekhi. Xhuma isevisi kunethiwekhi encane efanele, uhambise uhla lwayo lomthombo, bese uhlola leyo nguqulo.

Umhubhe uyasebenza, i-VM ifinyelela iseva yasekhaya, kodwa isevisi ye-Cloud Run iphelelwa isikhathi kusihambisi esifanayo. Lesi isiqalo esijwayelekile salo msebenzi, futhi umhubhe awuvamile ukuba yiwona onephutha. Inguqulo ye-Cloud Run ayihlali ku-VPC yakho ngokwezikhathi eziningi, futhi uma ihlala, isebenzisa amakheli ayo omthombo esikhundleni senethiwekhi encane ye-VM osuvele uyihambisile. Incwadi yokusebenza engezansi ixhuma isevisi, ihambisa uhla lwayo lomthombo wangempela, bese ifakazela indlela kusukela kunguqulo eyasebenzela isicelo. Yiqhube ngalolo hlelo, ngoba ukweqa isinyathelo sokuqala yikho okwenza izimo eziningi ezinjalo ziphele ngoshintsho lwe-VPN olungalungisi lutho.

Xhuma inguqulo ngaphambi kokulungisa umhubhe

I-Cloud Run isekela i-Direct VPC egress, ebeka ukuhamba kwesevisi kunethiwekhi encane ku-VPC yakho ngaphandle kwesixhumi se-Serverless VPC Access. Kusevisi esivele ikhona, isibuyekezo sibonakala kanje:

gcloud run services update SERVICE \
  --region=REGION --network=NETWORK --subnet=SUBNET \
  --vpc-egress=private-ranges-only

Shintsha izindawo ezibambekayo, buyekeza ukuthi ukusetshenziswa kwenza ini ekuhambeni okuphilayo, bese ukhetha inethiwekhi encane esifundeni sesevisi enamandla anele amakheli nezimvume zokuxhumana ezifanele.

Khetha imodi yokuphuma ehambisana nendawo

private-ranges-only ithumela izindawo eziyihlukanisa njengeziyimfihlo nge-VPC. Lokho akusho ukuthi «konke okufinyeleleka nge-VPN», futhi leso sikhala sivela lapho isevisi yasekhaya isesigabeni esingasihlukanisi kanjalo isilungiselelo. Uma indawo ingamboziwe, khona-ke all-traffic iyimodi enye ebhaliwe, futhi ithumela konke nge-VPC, kuhlanganise nokuncika komphakathi kwesevisi. Khetha ngokuqaphela bese ubhala umphumela kurekhodi loshintsho.

Isevisi esivele isebenzisa isixhumi idinga ukufuduka hhayi iswishi, ngakho yihlele esikhundleni sokuhlela kokubili.

Hambisa umthombo we-Cloud Run, hhayi umthombo we-VM

I-Direct VPC egress yabela amakheli esikhashana kusukela kunethiwekhi encane ekhethiwe, futhi uhlangothi lwasekhaya kumele lubuyisele ukuhamba kulolo hla. Indlela yokubuya noma imvume yodonga lomlilo ebhalelwe enye inethiwekhi encane ye-VM izobonakala ilungile kumdwebo kodwa ihluleke empilweni. Thatha i-CIDR yenethiwekhi encane ku-VPC hhayi enkumbulweni, bese uqinisekisa ukuthi i-crypto ACL noma ithebula lemizila yedivayisi ekude iyifaka.

Ngokuhamba okushintshayo, qinisekisa ukuthi i-Cloud Router imemezela ini ngempela nokuthi i-VPC ingenisa ini, kuhlanganise nanoma iyiphi inqubomgomo yokumemezela yangokwezifiso. Indlela ekhona kukhonsoli kodwa engakhethiwe yale ndawo ifana nokungabi nandlela.

Imibandela emithathu okumele yonke igcwaliseke

Indlela esebenzayo idinga konke lokhu okulandelayo, futhi ngakunye kwehluleka ngendlela yako:

  • Indlela ku-VPC ebheke esiqalweni sasekhaya ngoxhumano lwe-Cloud VPN oluhlosiwe.
  • Indlela yokubuya ohlangothini lwasekhaya yenethiwekhi encane ye-Cloud Run.
  • Ububanzi bokuvikela kodonga lomlilo ne-IPsec obuvumela umthombo, indawo kanye nembobo.

Indlela engekho ivamise ukubonakala njengokuphela kwesikhathi ngaphandle kobufakazi ohlangothini olukude. Inkinga yendlela yokubuya ibonakala njengesicelo esifikayo nempendulo enyamalalayo. Inkinga yodonga lomlilo noma yesikhethi ingabonakala njengokwenqaba noma njengokuwa buthule, kuye ngedivayisi. Ukuthola ukuthi iyiphi kwezintathu onayo kunciphisa kakhulu umyalo olandelayo.

Ungafaki ikheli elilodwa lesikhashana le-Cloud Run ohlwini oluvunyelwe. Sebenzisa uhla lwenethiwekhi encane kanye nomklamo wokugunyaza ofanele uhlelo lokusebenza.

Hlola inguqulo eyasebenzela isicelo

Hlola izilungiselelo zokuxhumana ezisetshenzisiwe kanye nokwabiwa kokuhamba ngaphambi kokuhlola, ngoba isibuyekezo singakha inguqulo entsha ngenkathi izicelo zisafinyelela eyendala. Bese wenza umsebenzi ofanayo owenziwa isicelo somsebenzisi, kusukela kuleyo nguqulo. Uma indawo iyigama lesihambisi esiyimfihlo, hlola ukuxazululwa kwalo kuleyo ndawo kanye nekheli elikhiqizile, ngoba impendulo ye-DNS yenkampani evela kukhompyutha yakho ayifakazeli lutho ngesikhala samagama sesevisi. Gcina ukuqinisekiswa kwegama lesihambisi se-TLS kanye nokuqinisekiswa kohlelo lokusebenza olukude ngokwakho.

Linde ukubambezeleka kokuxhumana kokuqala kwe-Direct VPC okubhaliwe, bese unikeza iklayenti isu lokulungela noma lokuzama futhi esikhundleni sokuhlola konke ukuqala okubandayo njengomhubhe ophukile.

Ukuhlehlisa nokuthi lokhu akukwenzi ini

Ukuze uhlehlise, buyisela izilungiselelo zokuxhumana nokuphuma zesevisi emananini azo angaphambili bese uqinisekisa ukuthi inguqulo yangaphambili isasebenzela ukuhamba. Gcina umyalo we-gcloud kurekhodi loshintsho, ngoba ukuphambuka koshintsho olungaphelele akucaci emavikini ayisithupha kamuva. Ukususa isixhumanisi se-VPC kubuyisela isevisi endleleni yayo yangaphambili yokuphuma, okungenzeka kube yikho kanye okukufunayo ngesikhathi sezehlakalo.

Lo mklamo uhlanganisa ukuxhumana okuqalwa yi-Cloud Run kanye nezimpendulo zako. Awuniki inethiwekhi yasekhaya isokhethi elikwazi ukukhethwa ngaphakathi kwesevisi, ngoba ukuchayeka ngaphakathi yisinqumo se-ingress.

Izihloko ezihlobene