透過自訂組織政策管理機群

您可以使用組織政策服務和自訂限制，在貴機構的 Managed Service for Apache Spark 叢集強制執行特定設定。這種集中式做法有助於確保合規性、控管成本，以及標準化 Managed Service for Apache Spark 機群。

本指南說明如何為 Managed Service for Apache Spark 叢集建立及強制執行自訂機構政策。詳情請參閱「組織政策簡介」。

事前準備

登入 Google Cloud 帳戶。如果您是 Google Cloud新手，歡迎 建立帳戶，親自體驗產品的實際應用成效。新客戶還能獲得價值 $300 美元的免費抵免額，能用於執行、測試及部署工作負載。

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Resource Manager API, if it is not already enabled.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the API

Make sure that you have the following role or roles on the project: Organization Policy Administrator

Check for the roles

1. In the Google Cloud console, go to the IAM page.

   Go to IAM
2. Select the project.

3. In the Principal column, find all rows that identify you or a group that you're included in. To learn which groups you're included in, contact your administrator.

4. For all rows that specify or include you, check the Role column to see whether the list of roles includes the required roles.

Grant the roles

1. In the Google Cloud console, go to the IAM page.

   Go to IAM
2. Select the project.
3. Click Grant access.

4. In the New principals field, enter your user identifier. This is typically the email address for a Google Account.

5. Click Select a role, then search for the role.
6. To grant additional roles, click Add another role and add each additional role.
7. Click Save.

Install the Google Cloud CLI.

Note: If you installed the gcloud CLI previously, make sure you have the latest version by running gcloud components update.

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

To initialize the gcloud CLI, run the following command:

gcloud init

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Resource Manager API, if it is not already enabled.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the API

Make sure that you have the following role or roles on the project: Organization Policy Administrator

Check for the roles

1. In the Google Cloud console, go to the IAM page.

   Go to IAM
2. Select the project.

3. In the Principal column, find all rows that identify you or a group that you're included in. To learn which groups you're included in, contact your administrator.

4. For all rows that specify or include you, check the Role column to see whether the list of roles includes the required roles.

Grant the roles

1. In the Google Cloud console, go to the IAM page.

   Go to IAM
2. Select the project.
3. Click Grant access.

4. In the New principals field, enter your user identifier. This is typically the email address for a Google Account.

5. Click Select a role, then search for the role.
6. To grant additional roles, click Add another role and add each additional role.
7. Click Save.

Install the Google Cloud CLI.

Note: If you installed the gcloud CLI previously, make sure you have the latest version by running gcloud components update.

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

To initialize the gcloud CLI, run the following command:

gcloud init

強制執行自訂限制

下列步驟說明如何強制執行常見的安全防護規定：確保所有新的 Managed Service for Apache Spark 叢集都已啟用 Kerberos。

1. 定義自訂限制條件。

   1. 建立 YAML 檔案，並加入以下內容：

   name: organizations/ORGANIZATION_ID/customConstraints/custom.dataprocKerberos
   resourceTypes:
   -   dataproc.googleapis.com/Cluster
   methodTypes:
   -   CREATE
   condition: "resource.config.securityConfig.kerberosConfig.enableKerberos == true"
   actionType: ALLOW
   displayName: Cluster must have Kerberos enabled.
   

   將 ORGANIZATION_ID 替換為您的機構 ID。

2. 設定自訂限制，讓貴機構可以使用。

   gcloud org-policies set-custom-constraint CONSTRAINT_PATH
   

   將 CONSTRAINT_PATH 替換為 YAML 限制檔案的路徑。

3. 建立強制執行限制的組織政策。

   1. 建立另一個 YAML 檔案，並加入以下內容：

   name: projects/PROJECT_ID/policies/custom.dataprocKerberos
   spec:
     rules:
       -   enforce: true
   

   將 PROJECT_ID 替換為要套用政策的專案 ID。您也可以在資料夾或機構層級套用這項政策。

4. 套用政策。

   gcloud org-policies set-policy POLICY_PATH
   

   將 POLICY_PATH 替換為 YAML 政策檔案的路徑。

套用政策後，如果嘗試在指定資源中建立 Managed Service for Apache Spark 叢集，但未啟用 Kerberos，就會失敗。

注意： 政策最多可能需要 15 分鐘才能傳播。

自訂限制的用途

您可以建立自訂限制，為 Managed Service for Apache Spark 機群強制執行各種政策。套用機群政策有助於控管成本、標準化及確保安全。

例如：您可以要求特定機型，或禁止叢集節點使用公開 IP 位址。

後續步驟

• 請參閱「組織政策簡介」
• 進一步瞭解自訂限制。