透過虛擬私有端點閘道存取 VPC 叢集

系統會為每個 VPC 叢集自動建立一個虛擬私有端點(VPE)閘道。若經授權的使用者已連線至同一 VPC 網路（例如透過 VPC VPN ），即可透過此端點存取叢集主節點。

對於執行版本 4.13：若您在建立叢集時僅啟用了私有雲服務端點，系統預設會使用您的 VPC 的 VPE 來存取 Red Hat OpenShift 組件，例如網頁控制台或 OperatorHub。您必須連接到私有 VPC 網路，才能存取這些元件。

開始之前

安裝所需的 CLI 工具。
設定從客戶端到站點或站點到站點的 VPN 連線至您的 VPC，並建立連線。

透過 VPE 閘道存取 VPC 叢集

使用 VPE 端點設定叢集上下文。

ibmcloud oc cluster config -c CLUSTER_NAME_OR_ID --endpoint vpe

請使用以下任一方法登入叢集。
- 以管理員身分：ibmcloud oc cluster config -c CLUSTER_NAME_OR_ID --admin --endpoint vpe
- 若使用 API 金鑰：請參閱「從自動化工具存取叢集」。
- 需輸入密碼：oc login -u passcode -p <iam_passcode> --server=https://<VPE_URL>:<port>
驗證存取權限。
```
oc version
```

在其他 VPC 和帳戶中建立額外的 VPE 閘道

除了為叢集在其 VPC 中建立的 VPE 閘道之外，您還可以為該叢集建立額外的 VPE 閘道，以便允許其他 VPC、區域及帳戶透過私有網路進行存取。

必須透過 CLI 或 API 建立額外的 VPE 閘道。建立後，即可透過網頁使用者介面進行管理。
對於跨帳戶的 VPE 閘道，您必須先在目標帳戶中建立授權。如需更多資訊，請參閱控制台中的「為跨帳戶 VPE 建立服務授權」。
無需中繼閘道或特殊路由設定。 VPE 閘道負責處理通往目標叢集的路由。

以下步驟將向您說明如何建立跨帳戶的 VPE 閘道。

從目標叢集中取得所需資訊。

將 ibmcloud target 設定為目標帳戶、區域及資源群組。
取得現有的 VPE 閘道資訊。

    ibmcloud is endpoint-gateway iks-TARGET_CLUSTER_ID
    ```
1. 請記下**目標 CRN** （格式：`crn:v1:bluemix:public:containers-kubernetes:REGION:a/TARGET_ACCOUNT:TARGET_CLUSTER_ID::` ）。

1. 請記下**服務端點**的主機名稱。

在來源帳戶中建立新的 VPE 閘道。

將 ibmcloud target 設定為來源帳戶、區域及資源群組。
請確認此帳戶中是否存在該 VPC。

    ibmcloud is vpcs
    ```
1. 建立 VPE 閘道。

```sh {: pre}
    ibmcloud is endpoint-gateway-create --vpc SOURCE_VPC_NAME --target TARGET_CRN --name new-iks-TARGET_CLUSTER_ID --resource-group-name SOURCE_ACCOUNT_RESOURCE_GROUP
    ```
    `SOURCE_VPC_NAME`
    :   上一步驟中的 VPC 名稱。

    `TARGET_CRN`
    :   來自目標叢集 VPE 閘道的 CRN。

    `--name`
    :   您 VPE 閘道的名稱。

    `SOURCE_ACCOUNT_RESOURCE_GROUP`
    :   來源帳戶中的資源群組名稱。

1. 若出現錯誤訊息「`Could not find service`」，請確認目標 CRN 是否正確。 如果無誤，您需要在目標帳戶中建立授權。 請參 [閱控制台中的「為跨帳戶 VPE 建立服務授權](/docs/vpc?topic=vpc-ordering-cross-account-endpoint-gateway&interface=ui#cross-account-vpe-prerequisite-console)」。

將預留 IP 位址新增至您的 VPE 閘道。

您必須至少新增一個保留 IP 位址。預留 IP 位址來自您的來源 VPC 子網（每個區域最多一個），並會新增至來源 VPC 的私有 DNS 條目中。

為每個區域建立一個保留 IP 位址。

    ibmcloud is subnet-reserved-ip-create SOURCE_VPC_SUBNET_NAME --vpc SOURCE_VPC_NAME --name ANY_NAME_YOU_CHOOSE --auto-delete true --target VPE_GATEWAY_NAME
    ```
1. （可選）：新增或修改安全群組。 預設情況下，僅會附加來源 VPC 的預設安全群組。 對於 VPE 閘道，安全群組僅保護入站流量。 請確保安全群組允許來自所有客戶端的所有必要傳入流量。

測試連線。

從來源 VPC 中的 VSI 出發時，請使用與原始 VPE 閘道相同的主機名稱。請在「服務端點」清單中，或透過 ibmcloud ks cluster get -c CLUSTER_NAME 查閱 VPE Gateway 屬性來找到此項目。
請確認連線是否正常。

    curl -k https://CLUSTERID...:XXXXX/version
    ```
1. 若連線失敗，請檢查以下事項：

    * VSI 和 VPE 閘道上的安全性群組會允許必要的流量
    * VPC 存取控制清單（ACL）允許該流量
    * 目標叢集上的「基於情境的限制」（CBR）規則允許來自來源 VPC 的私有流量（請將來源 VPC 中的三個 `Cloud Service Endpoint source addresses` 網址新增至私有 CBR 規則中）

目標帳戶範例

以下範例展示在目標帳戶中執行的指令，用以蒐集有關叢集及其 VPE 閘道器的資訊。

請確認您鎖定的帳戶是否正確。

ibmcloud target

輸出範例

API endpoint:     https://cloud.ibm.com
Region:           us-east
User:             user2@example.com
Account:          Target Account (9f8e7d6c5b4a321fedcba98765432222) <-> 2222222
Resource group:   default

請列出您的叢集。

ibmcloud ks clusters

輸出範例

OK
Name                     ID                     State    Created     Workers   Location        Version                  Resource Group Name   Provider
vpe-cross-account-test   c8m5n3p2q4x6z1w7y077   normal   1 day ago   2         Washington DC   4.19.25_1572_openshift   default               vpc-gen2

取得 VPE 閘道器的詳細資訊。請記下目標 CRN 及服務端點。

ibmcloud is endpoint-gateway iks-c8m5n3p2q4x6z1w7y077

輸出範例

Getting endpoint gateway iks-c8m5n3p2q4x6z1w7y077 under account Target Account as user user2@example.com...
ID                            r014-7a228b24-4bc4-416c-aede-7fda14e88d98   
Name                          iks-c8m5n3p2q4x6z1w7y077
CRN                           crn:v1:bluemix:public:is:us-east:a/9f8e7d6c5b4a321fedcba98765432222::endpoint-gateway:r014-7a228b24-4bc4-416c-aede-7fda14e88d98
Target                        CRN      
                              crn:v1:bluemix:public:containers-kubernetes:us-east:a/9f8e7d6c5b4a321fedcba98765432222:c8m5n3p2q4x6z1w7y077::
DNS resolution binding mode   primary   
Target Type                   provider_cloud_service   
Target Remote                 ID                        Name   Resource type      
                              No target remote found.      
VPC                           ID                                          Name      
                              r014-464b4e54-48a8-4f6c-b10a-68edc6fd2be4   new-vpcgen2-default-sec-grp-wdc      
Private IPs                   ID                                          Name                                   Address       Subnet ID      
                              0757-3bd457cb-af5a-4ab6-b9bb-6e78d3eaf752   iks-useast1-c8m5n3p2q4x6z1w7y077-2e8   172.22.0.11   0757-0c981aa5-cb47-41d9-ab29-edee98b416f8
Service Endpoints             c8m5n3p2q4x6z1w7y077.vpe.private.us-east.containers.cloud.ibm.com
Lifecycle State               stable   
Health State                  ok   
Security groups               ID                                          Name      
                              r014-3873358e-3180-482b-927e-abcc300ecbf8   kube-vpegw-c8m5n3p2q4x6z1w7y077
Created                       2026-04-03T12:14:59-05:00   
Resource Group                default

（可選）：取得叢集詳細資訊，以查看 VPE 閘道 URL。

ibmcloud ks cluster get -c c8m5n3p2q4x6z1w7y077

輸出範例

Retrieving cluster c8m5n3p2q4x6z1w7y077...
OK
Name:                           vpe-cross-account-test
ID:                             c8m5n3p2q4x6z1w7y077
State:                          normal
Status:                         All Workers Normal
Created:                        2026-04-03 11:56:38 -0500 (1 day ago)
Resource Group ID:              950cec30388441ce809ca0d18b5ca3bc
Resource Group Name:            default
Pod Subnet:                     172.17.0.0/18
Service Subnet:                 172.21.0.0/16
Workers:                        2
Worker Zones:                   us-east-1
Ingress Subdomain:              vpe-cross-account-test-354226545946e7ee0a2c700f061c1661-0000.us-east.containers.appdomain.cloud
Ingress Secret:                 vpe-cross-account-test-354226545946e7ee0a2c700f061c1661-0000
Ingress Status:                 healthy
Ingress Message:                All Ingress components are healthy.
Trusted Profile ID:             -
Public Service Endpoint URL:    https://c111-e.us-east.containers.cloud.ibm.com:31100
Private Service Endpoint URL:   https://c111.private.us-east.containers.cloud.ibm.com:31100
Pull Secrets:                   enabled in the default namespace
VPCs:                           r014-464b4e54-48a8-4f6c-b10a-68edc6fd2be4
VPE Gateway:                    https://c8m5n3p2q4x6z1w7y077.vpe.private.us-east.containers.cloud.ibm.com:31100
OAuth Server URL:               https://c111-e.us-east.containers.cloud.ibm.com:31264
Konnectivity Server URL:        https://c8m5n3p2q4x6z1w7y077.vpe.private.us-east.containers.cloud.ibm.com:30996
Secure By Default Networking:   enabled
Outbound Traffic Protection:    enabled
Master      
Status:     Ready (1 day ago)
State:      deployed
Health:     normal
Version:    4.19.25_1572_openshift
Location:   Washington DC
URL:        https://c111-e.us-east.containers.cloud.ibm.com:31100

來源帳戶範例

以下範例展示在來源帳戶中執行的指令，用以建立一個可連線至目標帳戶中叢集的 VPE 閘道。

請確認您鎖定的目標是正確的來源帳戶。

ibmcloud target

輸出範例

API endpoint:     https://cloud.ibm.com
Region:           us-south
User:             user1@example.com
Account:          Source Account (a1b2c3d4e5f6789abcdef01234561111) <-> 1111111
Resource group:   Default

列出您的 VPC。

ibmcloud is vpcs

輸出範例

Listing vpcs in resource group Default and region us-south under account Source Account as user user1@example.com...
ID                                          Name                      Status      Classic access   Default network ACL                             Default security group                           Resource group   Health state   DNS Hub   DNS Resolver Type   
r006-6f450c4b-c808-40e7-9de6-c61c262a2ae9   dev-ansiblepr-vpc         available   false            vendor-paradox-ravioli-tank                     harmonica-hypnoses-tranquil-alkalize             Default          ok             false     system   
r006-bd06a98a-1183-42d2-810d-1c564eeb5f39   fvt-vpc-sdnlb-server-40   available   false            sloppy-program-venue-subsiding                  prattle-pension-wilt-recycled                    Default          ok             false     system   
r006-ecf65055-6868-4368-aa7c-48fc5ac29ff8   network-fvt-us-south      available   false            doorknob-baffle-quintet-poem                    spotted-sandpaper-auction-unluckily              Default          ok             false     system   
r006-4ff93772-cee9-4d64-9d87-d8b1b781e201   network-fvt-vpc-gen2      available   false            stegosaur-reach-boxlike-alone-stranger-uncork   earplugs-preface-county-juicy-sensitize-babied   Default          ok             false     system

請使用目標帳戶的「目標 CRN」來建立 VPE 閘道。

ibmcloud is endpoint-gateway-create --vpc network-fvt-us-south --target crn:v1:bluemix:public:containers-kubernetes:us-east:a/9f8e7d6c5b4a321fedcba98765432222:c8m5n3p2q4x6z1w7y077:: --name new-iks-c8m5n3p2q4x6z1w7y077 --resource-group-name Default

輸出範例

Creating endpoint gateway new-iks-c8m5n3p2q4x6z1w7y077 in resource group Default under account Source Account as user user1@example.com...
ID                            r006-2009f147-768a-4f6a-b8fa-75f20456cec2   
Name                          new-iks-c8m5n3p2q4x6z1w7y077
CRN                           crn:v1:bluemix:public:is:us-south:a/a1b2c3d4e5f6789abcdef01234561111::endpoint-gateway:r006-2009f147-768a-4f6a-b8fa-75f20456cec2
Target                        CRN      
                              crn:v1:bluemix:public:containers-kubernetes:us-east:a/9f8e7d6c5b4a321fedcba98765432222:c8m5n3p2q4x6z1w7y077::
DNS resolution binding mode   primary   
Target Type                   provider_cloud_service   
Target Remote                 ID                        Name   Resource type      
                              No target remote found.      
VPC                           ID                                          Name      
                              r006-ecf65055-6868-4368-aa7c-48fc5ac29ff8   network-fvt-us-south      
Private IPs                   -   
Service Endpoints             c8m5n3p2q4x6z1w7y077.vpe.private.us-east.containers.cloud.ibm.com
Lifecycle State               pending   
Health State                  ok   
Security groups               ID                                          Name      
                              r006-7ae081e2-743d-4046-b755-5ca9997ae077   spotted-sandpaper-auction-unluckily      
Created                       2026-04-04T18:17:12-05:00   
Resource Group                Default

請列出子網，以便確定哪些子網應用於預留 IP 位址。

ibmcloud is subnets --vpc network-fvt-us-south

輸出範例

Listing subnets in resource group Default and region us-south under account Source Account as user user1@example.com...
ID                                          Name                           Status      Subnet CIDR       Addresses   ACL                            Public Gateway                             VPC                    Zone         Resource group   
0717-04288f84-4aef-4938-9fa7-5544a40ba258   network-fvt-us-south-1-priv    available   10.240.0.0/24     251/256     doorknob-baffle-quintet-poem   -                                          network-fvt-us-south   us-south-1   Default   
0717-cdd4b20c-b48f-454b-b092-ad7aa14b39c8   network-fvt-us-south-1-pubgw   available   10.240.1.0/24     246/256     doorknob-baffle-quintet-poem   pgw-33eb53d0-74e4-11ee-a747-33927b3ab784   network-fvt-us-south   us-south-1   Default   
0727-8813de08-fffa-45e3-ae67-2ba70703866e   network-fvt-us-south-2-priv    available   10.240.64.0/24    250/256     doorknob-baffle-quintet-poem   -                                          network-fvt-us-south   us-south-2   Default   
0727-50b14707-c9f6-4f93-9f49-99de13c66161   network-fvt-us-south-2-pubgw   available   10.240.65.0/24    251/256     doorknob-baffle-quintet-poem   pgw-34fe4a70-74e4-11ee-a747-33927b3ab784   network-fvt-us-south   us-south-2   Default   
0737-7a644374-f121-44c1-b216-5fd94c0362b2   network-fvt-us-south-3-priv    available   10.240.128.0/24   251/256     doorknob-baffle-quintet-poem   -                                          network-fvt-us-south   us-south-3   Default   
0737-71a34942-304c-4419-9205-3714a3574962   network-fvt-us-south-3-pubgw   available   10.240.129.0/24   251/256     doorknob-baffle-quintet-poem   pgw-36088e80-74e4-11ee-a747-33927b3ab784   network-fvt-us-south   us-south-3   Default

在第一個區域中建立一個保留 IP，並將其綁定至 VPE 閘道。

ibmcloud is subnet-reserved-ip-create network-fvt-us-south-1-pubgw --vpc network-fvt-us-south --name reserved-ip-for-us-south-1 --auto-delete true --target new-iks-c8m5n3p2q4x6z1w7y077

輸出範例

Creating reserved IP in subnet network-fvt-us-south-1-pubgw under account Source Account as user user1@example.com...
ID                0717-685e1410-2fa1-4e7a-a4e5-27a097ec7a7a   
Name              reserved-ip-for-us-south-1   
Address           0.0.0.0   
Auto delete       true   
Owner             user   
Created           2026-04-04T18:18:51-05:00   
Lifecycle state   pending   
Target            ID                                          Name                           Resource type      CRN      
                  r006-2009f147-768a-4f6a-b8fa-75f20456cec2   new-iks-c8m5n3p2q4x6z1w7y077   endpoint_gateway   crn:v1:bluemix:public:is:us-south:a/a1b2c3d4e5f6789abcdef01234561111::endpoint-gateway:r006-2009f147-768a-4f6a-b8fa-75f20456cec2

請確認已新增該預留 IP 位址。

ibmcloud is eg new-iks-c8m5n3p2q4x6z1w7y077

輸出範例

Getting endpoint gateway new-iks-c8m5n3p2q4x6z1w7y077 under account Source Account as user user1@example.com...
ID                            r006-2009f147-768a-4f6a-b8fa-75f20456cec2   
Name                          new-iks-c8m5n3p2q4x6z1w7y077
CRN                           crn:v1:bluemix:public:is:us-south:a/a1b2c3d4e5f6789abcdef01234561111::endpoint-gateway:r006-2009f147-768a-4f6a-b8fa-75f20456cec2
Target                        CRN      
                              crn:v1:bluemix:public:containers-kubernetes:us-east:a/9f8e7d6c5b4a321fedcba98765432222:c8m5n3p2q4x6z1w7y077::
DNS resolution binding mode   primary   
Target Type                   provider_cloud_service   
Target Remote                 ID                        Name   Resource type      
                              No target remote found.      
VPC                           ID                                          Name      
                              r006-ecf65055-6868-4368-aa7c-48fc5ac29ff8   network-fvt-us-south      
Private IPs                   ID                                          Name                         Address      Subnet ID      
                              0717-685e1410-2fa1-4e7a-a4e5-27a097ec7a7a   reserved-ip-for-us-south-1   10.240.1.5   0717-cdd4b20c-b48f-454b-b092-ad7aa14b39c8      
Service Endpoints             c8m5n3p2q4x6z1w7y077.vpe.private.us-east.containers.cloud.ibm.com
Lifecycle State               stable   
Health State                  ok   
Security groups               ID                                          Name      
                              r006-7ae081e2-743d-4046-b755-5ca9997ae077   spotted-sandpaper-auction-unluckily      
Created                       2026-04-04T18:17:12-05:00   
Resource Group                Default

在第二個區域中建立一個保留 IP，並將其綁定至 VPE 閘道。

ibmcloud is subnet-reserved-ip-create network-fvt-us-south-2-pubgw --vpc network-fvt-us-south --name reserved-ip-for-us-south-2 --auto-delete true --target new-iks-c8m5n3p2q4x6z1w7y077

輸出範例

Creating reserved IP in subnet network-fvt-us-south-2-pubgw under account Source Account as user user1@example.com...
ID                0727-d315d943-c501-4f69-823d-bb82a2b13b29   
Name              reserved-ip-for-us-south-2   
Address           0.0.0.0   
Auto delete       true   
Owner             user   
Created           2026-04-04T18:19:24-05:00   
Lifecycle state   pending   
Target            ID                                          Name                           Resource type      CRN      
                  r006-2009f147-768a-4f6a-b8fa-75f20456cec2   new-iks-c8m5n3p2q4x6z1w7y077   endpoint_gateway   crn:v1:bluemix:public:is:us-south:a/a1b2c3d4e5f6789abcdef01234561111::endpoint-gateway:r006-2009f147-768a-4f6a-b8fa-75f20456cec2

在第三個區域中建立一個保留 IP，並將其綁定至 VPE 閘道。

ibmcloud is subnet-reserved-ip-create network-fvt-us-south-3-pubgw --vpc network-fvt-us-south --name reserved-ip-for-us-south-3 --auto-delete true --target new-iks-c8m5n3p2q4x6z1w7y077

輸出範例

Creating reserved IP in subnet network-fvt-us-south-3-pubgw under account Source Account as user user1@example.com...
ID                0737-afbebd9f-02bd-4b9a-be90-5bacf9836041   
Name              reserved-ip-for-us-south-3   
Address           0.0.0.0   
Auto delete       true   
Owner             user   
Created           2026-04-04T18:19:32-05:00   
Lifecycle state   pending   
Target            ID                                          Name                           Resource type      CRN      
                  r006-2009f147-768a-4f6a-b8fa-75f20456cec2   new-iks-c8m5n3p2q4x6z1w7y077   endpoint_gateway   crn:v1:bluemix:public:is:us-south:a/a1b2c3d4e5f6789abcdef01234561111::endpoint-gateway:r006-2009f147-768a-4f6a-b8fa-75f20456cec2

請確認所有已預留的 IP 位址均已新增。

ibmcloud is eg new-iks-c8m5n3p2q4x6z1w7y077

輸出範例

Getting endpoint gateway new-iks-c8m5n3p2q4x6z1w7y077 under account Source Account as user user1@example.com...
ID                            r006-2009f147-768a-4f6a-b8fa-75f20456cec2   
Name                          new-iks-c8m5n3p2q4x6z1w7y077
CRN                           crn:v1:bluemix:public:is:us-south:a/a1b2c3d4e5f6789abcdef01234561111::endpoint-gateway:r006-2009f147-768a-4f6a-b8fa-75f20456cec2
Target                        CRN      
                              crn:v1:bluemix:public:containers-kubernetes:us-east:a/9f8e7d6c5b4a321fedcba98765432222:c8m5n3p2q4x6z1w7y077::
DNS resolution binding mode   primary   
Target Type                   provider_cloud_service   
Target Remote                 ID                        Name   Resource type      
                              No target remote found.      
VPC                           ID                                          Name      
                              r006-ecf65055-6868-4368-aa7c-48fc5ac29ff8   network-fvt-us-south      
Private IPs                   ID                                          Name                         Address        Subnet ID      
                              0737-afbebd9f-02bd-4b9a-be90-5bacf9836041   reserved-ip-for-us-south-3   10.240.129.5   0737-71a34942-304c-4419-9205-3714a3574962      
                              0717-685e1410-2fa1-4e7a-a4e5-27a097ec7a7a   reserved-ip-for-us-south-1   10.240.1.5     0717-cdd4b20c-b48f-454b-b092-ad7aa14b39c8      
                              0727-d315d943-c501-4f69-823d-bb82a2b13b29   reserved-ip-for-us-south-2   10.240.65.5    0727-50b14707-c9f6-4f93-9f49-99de13c66161      
Service Endpoints             c8m5n3p2q4x6z1w7y077.vpe.private.us-east.containers.cloud.ibm.com
Lifecycle State               stable   
Health State                  ok   
Security groups               ID                                          Name      
                              r006-7ae081e2-743d-4046-b755-5ca9997ae077   spotted-sandpaper-auction-unluckily      
Created                       2026-04-04T18:17:12-05:00   
Resource Group                Default

從來源 VPC 中的 VSI 測試連線。

curl -k https://c8m5n3p2q4x6z1w7y077.vpe.private.us-east.containers.cloud.ibm.com:31100/version

輸出範例

{
  "major": "1",
  "minor": "32",
  "gitVersion": "v1.32.12",
  "gitCommit": "9b706b45b52a0c8bb05847295ee98ffccbabba32",
  "gitTreeState": "clean",
  "buildDate": "2026-02-19T13:30:47Z",
  "goVersion": "go1.23.10 (Red Hat 1.23.10-10.el9) X:strictfipsruntime",
  "compiler": "gc",
  "platform": "linux/amd64"
}

確認主機名稱能否解析至預留的 IP 位址。

dig +short c8m5n3p2q4x6z1w7y077.vpe.private.us-east.containers.cloud.ibm.com

輸出範例

10.240.65.5