I have this GKE autopilot cluster and I'm trying to setup a Load Balancer for it's services. The caveat is: Instead of defining an Ingress for the cluster, which would create the LB and all the related configs, I have to manually define an LB.
GKE creates all the NEGs I need and I'm just pointing existing cluster to them as backends, and it works fine.
The problem: I can't manually create a firewall rule allowing the health check networks to reach the pods because the rule expects to receive a TAG as its target, but autopilot GKE hides all info ref. its nodes, e.g. the tags automatically created.
This is an example of firewall rule created by the GKE ingress controller:
Name: gke-autopilot-gke-cluster-XXXXX-xxxxx-egress Target: gke-autopilot-gke-cluster-XXXXXX-node
I could create a firewall rule targeting the entire VPC/subnet, but how to achieve the node granularity within an autopilot cluster if I don't know the TAG the nodes will get?