GKE – Connecting Pods via VPN

google-kubernetes-enginekubernetesvpn

I have a GKE cluster with a handful of nodes and I would like pods in this cluster to be able to connect to remote hosts on a private network that can be reached via a site-to-site VPN provided by GCE. As far as I can tell, there is no simple way to assign an address to a pod for outbound connections? (It does not seem feasible to add each pod-cidr to VPN configuration each time a node is added or replaced.) Do I have to set up a NAT bradge external to the cluster, or is there some Kubernetes way to control the outbound address of a pod?

Best Answer

Instead of adding each node's pod-CIDR to the VPN config, you could add the entire cluster-CIDR (where any new/recreated nodes will have their pod-CIDRs pulled from).

To find the cluster-cidr:

gcloud container clusters describe your-cluster | grep clusterIpv4Cidr

Related Solutions

Traffic not routed back to GKE cluster from remote network via VPN

If IP address 10.248.0.26 belongs to a GKE node, then for doing ping between the GKE node and your remote node you will need to add a firewall rule on 10.248.0.26/24 network to allow incoming traffic to GKE node or all targets in that network from your remote source.

Kubernetes – Avoid Using GCE Load Balancer to Reduce Cost

Yes, via ExternalIPs. Be aware that this will mean your service will go down if the node that has said external IP assigned fails, but if you're only running 1 master you probably don't care much about that.

Example service:

apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  ports:
    - port: 80
      protocol: TCP
  selector:
    app: myapp
  externalIPs:
    - a.b.c.d

The IP need to be the internal IP of the GCE instance (This is because GCE DNATs the traffic to the internal IPs). The service should then be accessible via the node's assigned external IP.

You will probably want to change the service for your ingress controller, so that you can route all of your apps through one IP.

Best Answer

Related Solutions

Traffic not routed back to GKE cluster from remote network via VPN

Kubernetes – Avoid Using GCE Load Balancer to Reduce Cost

Related Topic