1

I'm running in a GKE cluster (1.15.12-gke.2) some applications that need to connect to a third-party API. This third-party API has mandatory IP filtering. So in order to get API authorized, I need to declare what are the public IP that I'll use to connect to the API. My problem is that public IPs of GKE nodes are not stable across upgrade and it would prevent the use of node autoscaling & after every time of nodes restart IP will change

Is there any way to have a stable outbound public IP on GKE?

Thanks -Ashok Patidar

Improve this question
1

1 Answer 1

Reset to default
3

As I said in my comment, the solution to have a static outbound IP in GKE is to use Cloud NAT.

Disclaimer!

A Cloud NAT gateway can perform NAT for nodes and Pods in a private cluster, which is a type of VPC-native cluster.

Cloud.google.com: NAT: Docs: Overview: NAT with GKE

You can read more about private GKE clusters by following official documentation:

There is also an official guide showing the process of creating a private GKE cluster and then connecting it with Cloud NAT:

When following above guide you can choose to use previously reserved static IP address or create a new one. This will be the IP that GKE nodes and pods will be using when communicating with "outside".

I ran a test where I spawned private GKE cluster with 3 nodes. Created pods that each one of them was scheduled on a different node. Every pod sent a packet to a remote server. Listening on remote server showed that every pod that sent a message had the same source IP:

tcpdump: listening on ens4, link-type EN10MB (Ethernet), capture size 262144 bytes
14:06:11.692832 IP (tos 0x0, ttl 54, id 46751, offset 0, flags [DF], proto TCP (6), length 60)
    35.198.XXX.XXX.1027 > 10.168.0.2.9833: # NODE1 (POD1) TO SERVER
    10.168.0.2.9833 > 35.198.154.155.1027: # REPLY TO (POD1)
    35.198.XXX.XXX.2051 > 10.168.0.2.9833: # NODE2 (POD2) TO SERVER
    10.168.0.2.9833 > 35.198.154.155.2051: # REPLY TO (POD2)
    35.198.XXX.XXX.1538 > 10.168.0.2.9833: # NODE3 (POD3) TO SERVER
    10.168.0.2.9833 > 35.198.154.155.1538: # REPLY TO (POD3)
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .