準備為 Cloud Service Mesh 設定 Gateway API

本頁說明如何在叢集中安裝閘道所需的自訂資源定義。

限制

  • 不支援在同一機群中混用 gateway config-api 和 istio config-api 叢集。
  • gateway config-api 叢集不支援多叢集服務探索和負載平衡。
  • 如果叢集是使用現有的 --management automatic 旗標上線，叢集就會開始使用 istio 設定 API，且無法變更為 gateway API。
  • 系統僅支援 FQDN。系統不支援簡稱。

必要條件

本指南假設您已建立 Google Cloud 專案並安裝 kubectl。

事前準備

  1. 登入 Google Cloud 帳戶。如果您是 Google Cloud新手，歡迎 建立帳戶，親自評估產品在實際工作環境中的成效。新客戶還能獲得價值 $300 美元的免費抵免額，可用於執行、測試及部署工作負載。

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Enable the Kubernetes Engine, GKE Hub, and Cloud Service Mesh APIs.

    Roles required to enable APIs

    To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

    Enable the APIs

  5. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  6. Verify that billing is enabled for your Google Cloud project.

  7. Enable the Kubernetes Engine, GKE Hub, and Cloud Service Mesh APIs.

    Roles required to enable APIs

    To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

    Enable the APIs

    8.

  1. 為叢集產生 kubeconfig 項目：
    2. gcloud container clusters get-credentials CLUSTER_NAME --location LOCATION --project PROJECT_ID

其中：

  • CLUSTER_NAME 是叢集名稱
  • LOCATION 是叢集的位置
  • PROJECT_ID 是叢集的專案 ID

建立及註冊 GKE 叢集

  1. 建立 GKE 叢集：

    gcloud container clusters create CLUSTER_NAME \
--location=LOCATION \
--enable-ip-alias \
--scopes=https://www.googleapis.com/auth/cloud-platform \
--release-channel=regular \
--project=PROJECT_ID \
--gateway-api=standard

    其中：

    • CLUSTER_NAME 是叢集名稱
    • LOCATION 是叢集的位置
    • PROJECT_ID 是叢集的專案 ID

  2. 啟用 Workload Identity Federation for GKE：

    gcloud container clusters update CLUSTER_NAME \
--location LOCATION \
--workload-pool=PROJECT_ID.svc.id.goog

  3. 在節點上執行 GKE 中繼資料伺服器：

    gcloud container node-pools update default-pool \
--cluster=CLUSTER_NAME \
--location=LOCATION \
--workload-metadata=GKE_METADATA

  4. 將叢集註冊至機群：

    gcloud container hub memberships register CLUSTER_NAME \
--gke-cluster LOCATION/CLUSTER_NAME \
--project=PROJECT_ID

  5. 確認叢集已向機群註冊：

    gcloud container hub memberships list --project=PROJECT_ID

    輸出內容類似如下：

    NAME            EXTERNAL_ID                             LOCATION
my-cluster      91980bb9-593c-4b36-9170-96445c9edd39    us-west1

設定權限

請注意，下列指令會將權限授予所有已通過驗證的使用者，但您可以使用 Workload Identity Federation for GKE，只將權限授予特定帳戶。

  1. 授予 trafficdirector.client 角色：

    gcloud projects add-iam-policy-binding PROJECT_ID \
    --member "group:PROJECT_ID.svc.id.goog:/allAuthenticatedUsers/" \
    --role "roles/trafficdirector.client"

  2. 授予 container.developer 角色：

    gcloud projects add-iam-policy-binding PROJECT_ID \
--member "serviceAccount:service-PROJECT_NUMBER@container-engine-robot.iam.gserviceaccount.com" \
--role "roles/container.developer"

    其中 PROJECT_NUMBER 是您的專案編號。

  3. 授予 compute.networkAdmin 角色：

    gcloud projects add-iam-policy-binding PROJECT_ID \
--member "serviceAccount:service-PROJECT_NUMBER@container-engine-robot.iam.gserviceaccount.com" \
--role "roles/compute.networkAdmin"

    其中 PROJECT_NUMBER 是您的專案編號。

啟用 Cloud Service Mesh

  1. 啟用網狀網路功能：

    gcloud container hub mesh enable --project PROJECT_ID

  2. 更新網格以使用 Gateway API：

    gcloud alpha container fleet mesh update \
--config-api gateway \
--memberships CLUSTER_NAME \
--project PROJECT_ID

  3. 說明 Cloud Service Mesh 資源的狀態，確認更新：

    gcloud alpha container fleet mesh describe

安裝自訂資源定義

安裝 GRPCRoute 自訂資源定義 (CRD)：

curl https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/v1.1.0/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml \
| kubectl apply -f -

輸出內容類似如下：

customresourcedefinition.apiextensions.k8s.io/grpcroutes.gateway.networking.k8s.io created

後續步驟