I-Google API nge-VPN: hambisa i-VIP, hhayi i-subnet kuphela
Indlela eya ku-subnet ye-VPC ayikhethi amakheli e-VIP e-API. Xazulula amagama afanele, memezela isiqalo se-VIP, gcina indlela yokubuya ku-VPC, bese uhlola i-HTTPS.
Ngena kuseva yasendaweni nge-SSH, phakamisa ithuneli futhi i-VM yangasese iyaphendula; bese ucingo lokuqala lwe-Google API luhluleka ngaphandle kwendlela. I-subnet ye-VM namakheli e-VIP e-API yizindawo ezihlukene, ngakho indlela eya kwenye ayikhethi enye. Izimo ezintathu kufanele zibe khona ngaphambi kokuba ucingo lwe-API lwangasese lusebenze. Igama le-API kufanele lixazululwe libe yi-VIP, isiqalo se-VIP kufanele simenyezelwe ngethuneli, futhi i-VPC kufanele yazi ukuthi ingayibuyisela kanjani impendulo. I-ping ayikutsheli lutho ngalokho, futhi neseshini ye-SSH esebenzayo eya emshinini okwi-subnet ayikutsheli.
Amakheli e-VIP e-API ayizindawo ezihlukene
I-Google ishicilela ama-VIP akhethekile okufinyelela i-API kusukela kunethiwekhi yasendaweni, futhi yilawo makheli i-DNS yakho okufanele iwabuyisele amagama e-API. Womabili ayiziqalo ezincane futhi akukho noyedwa oyisikhala se-RFC 1918:
| Record | Resolves to | What it does not give you |
|---|---|---|
| private.googleapis.com | 199.36.153.8/30, the general front door for Google APIs | not a bypass around a service perimeter |
| restricted.googleapis.com | 199.36.153.4/30, reachable only for services a perimeter allows | not the whole API surface, so some names stay out of reach |
Amakheli abukeka njengomphakathi awasho ukuthi indlela kufanele ishiye ithuneli kunethiwekhi evamile. Lezi ziqalo zikhona ukuze iklayenti yasendaweni ifinyelele izingxenye zangaphambili ze-Google ngendlela esekelwayo esikhundleni sendawo yokuphuma engakahleleki. Wabheke njengezindawo eziyingxenye yethuneli, hhayi njengamahosthi okuhlola. Umthetho we-firewall obhalelwe ukuphuma ku-internet uvamise ukuwalahla, futhi lesi yisizathu esivamile sokuthi ucingo luhluleke ngaphambi kokuba luqale.
I-DNS inquma ukuthi ufika kuyiphi indawo yokugcina
Khombisa isixazululi sasendaweni kumarekhodi e-Google ewabhalile endaweni yokugcina ekhethiwe, ukuze amagama adingwa uhlelo aphendule ngaleyo VIP. Ukwenza imephu googleapis.com kuphela akulona uhlu: amarejista amaphakethe, amarejista amakhonteyina nezixhumi zokufuduka anamagama awo abhaliwe. I-VIP ekhawulelwe nayo ayithwali zonke izinsiza, ngakho igama elixazululwayo lingase lingasekelwe. Bhala amadomeni uhlelo oluxhumana nawo ngempela ngaphambi kokuthinta isixazululi.
Ukuqagela ikheli le-VM ku-VPC esikhundleni segama lensiza akulona ukulungisa, futhi kuvamise ukufihla igebe le-DNS kuze kuhluleke elinye iklayenti.
Memezela isiqalo se-VIP, gcina okunye
Ngoxhumano olusekelwe ku-BGP, i-Cloud Router kufanele imemezele isiqalo se-VIP esikhethiwe ukuze i-rawutha yasendaweni ifunde lelo banga ngeseshini ehlosiwe. Ukumemezela ama-subnet e-VPC kuphela akulethi lelo banga, futhi i-rawutha yasendaweni iqhubeka isebenzisa indlela yayo ezenzakalelayo kulawo makheli. Isiqalo esikusetafuleni lokuhamba siwubufakazi obulodwa bokuthi isimemezelo sawela iseshini.
Gcina izimemezelo ezikhona ngenkathi wengeza esisha, ngoba izinketho zezinga le-rawutha nezezinga lika-peer zinobubanzi obuhlukene, futhi ukushintsha isethi kungahoxisa amanethiwekhi abesekhona. Bese uhlola isimemezelo esisebenzayo kuseshini ngayinye hhayi ku-rawutha yonke. Isiqalo esingekho nesiqalo esihoxisiwe zibukeka zifana ohlangothini lwasendaweni, ngakho umbono weseshini yiwo ohlukanisa ukweqiwa nokuhlehla.
Uhlangothi lwe-VPC ludinga indlela yalo nendlela yokubuya
Ngaphakathi kwe-VPC, indlela ye-VIP kufanele isebenzise isango le-internet elizenzakalelayo njengehop elilandelayo, futhi naphezu kwegama leyo traffic ihlala kwinethiwekhi ye-Google. I-VPC idinga nendlela yokubuya emthonjeni wasendaweni nge-VPN, futhi lokho kuyinto ehlukile kwisiqalo esimemezelwe. Cabanga ngezimfuneko zokuhamba zesifunda ezibhaliwe lapho ithuneli neklayenti zingekho esifundeni esisodwa.
Hlola indlela yokubuya ngokuzimela, ngoba isiqondiso sesicelo esisebenzayo singafihla isiqondiso sempendulo esiphukile. Iziqondiso ezimbili, izindlela ezimbili, futhi ngayinye ihluleka ngophawu lwayo.
Hlola isicelo, bese ufunda ukwenqatshwa
I-ICMP echo ayitholi mpendulo kula ma-VIP, ngakho i-ping ehlulekile ayifakazi lutho futhi ephumelelayo ifakaza okuncane kakhulu. Kusukela kuklayenti yangempela, hlola impendulo yegama nendlela ekhethiwe, bese wenza isicelo se-HTTPS esigunyaziwe kusiza okukhathaza wena. Uma isicelo sifika enzizeni futhi senqatshwa, bheka izifakaziso, i-IAM nanoma iyiphi inqubomgomo yomngcele wensiza esebenzayo.
Ukuhamba kwangasese akunikezi igunya le-API futhi akushintshi okwenziwa umuntu. Impumelelo yokuthutha nempendulo egunyaziwe yimiphumela ehlukene, futhi udinga kokubili. Gcina futhi indlela ye-IPv6 icacile, ngoba ukuhlela iziqalo ze-IPv4 akusho lutho ngoklayenti ekhetha i-IPv6.
Umhlahlandlela we-Google we-Private Google Access osuka kunethiwekhi yasendaweni uhlanganisa ndawonye amarekhodi e-DNS nezimfuneko zokuhamba, ngakho qhathanisa izilungiselelo zakho zesixazululi nesimemezelo nawo hhayi nokuthunyelwe kwenkundla. Bese ugijima futhi isicelo esifanayo futhi ubhale impendulo nendlela kutikithi elifanayo.