GKE VPC-native cluster networking from pod to service subnets

Question

So I created a VPC-native GKE cluster. My Pod address range is 10.17.0.0/16 and my Service address range is 10.16.1.0/24.

From a pod on my cluster I can’t resolve google.internal dns names. This seems to be caused by the fact that I can’t reach the service subnet from the pod subnet:

root@mypod-0:/# ifconfig|grep eth0 -A 1
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1460
        inet 10.17.2.40  netmask 255.255.255.0  broadcast 0.0.0.0
root@mypod-0:/# head -n 1 /etc/resolv.conf
nameserver 10.16.1.10
root@mypod-0:/# ping -c 1 -W 1 10.16.1.10
PING 10.16.1.10 (10.16.1.10) 56(84) bytes of data.

--- 10.16.1.10 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

root@mypod-0:/#

I have a firewall rule that allow all from 10.0.0.0/8. What am I missing here ?

Answer 1

You should follow the DNS rules stated below:

https://support.dnsimple.com/articles/differences-between-a-cname-alias-url/

https://www.linode.com/docs/networking/dns/dns-records-an-introduction/

https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/

This says that that if DNS service name is 10.16.1.0/24 then pods should have IP 10.16.1.1, 10.16.1.2 …….

You use IPs 10.17.0.0/16. It will not work.