8

I use Google Kubernetes Engine to run on demand pods. Each pod is publicly exposed to the internet using a nodeport service.

I am looking for a way in GKE to get a single IP or an IP range for outbound connections, to give them to third party API's to whitelist them.

The GKE node IPs are not manageable when nodes autoscale or when I upgrade them. I need a way to maintain a consistent outbound IP.

I have tried using a simple NAT Gateway to the Kubernetes nodes (Using the example from here), and while this routes the outbound connections to the NAT Gateway, it breaks inbound traffic to the pods(Nodeport service) since they get dropped off at the NAT gateway.

  • Is there a default IP range for a google cloud region which I can provide to the third party to whitelist (or)

  • If GKE provides a way to select node external IPs from a pre reserved list of static IP's (or)

  • Is there any other way to accomplish having a single static IP or an IP range that represents the outbound traffic from the pods

I have found similar questions like this, but they don't address my problem as the pods should be externally connectable, which breaks when using a NAT.

1

Your best bet for this setup is to use a LoadBalancer service or Ingress resource to handle inbound requests, you can assign a single static IP for all of your pods no matter how large it scales up. Then use the example you provided for outbound traffic.

The external IPs assigned to each node are ephemeral and are chosen from within the range of available Google IPs. Please see this stack post that discusses how to find the list of Google IPs.

  • Adding a loadbalancer or an Ingress won't help as the pods are stateful and I need direct access to them. I solved my problem by using a NAT gateway routed only for clients that needed whitelisted access and the default Internet Gateway for everyone else, specifically my servers – Parag Apr 12 '18 at 14:42
  • 1
    You should only have cluster Egress traffic going through the NAT gateway. Any ingress traffic should be directed through an Ingress or a Load Balancer. – Patrick W Apr 16 '18 at 17:47
0

You can try this solution :

https://cloud.google.com/solutions/using-a-nat-gateway-with-kubernetes-engine

Under normal circumstances, Google Kubernetes Engine nodes route all egress traffic through the internet gateway associated with their node cluster. The internet gateway connection, in turn, is defined by the Compute Engine network associated with the node cluster. Each node in the cluster has an ephemeral external IP address. When nodes are created and destroyed during autoscaling, new node IP addresses are allocated automatically.

The default gateway behavior works well under normal circumstances. However, you might want to modify how ephemeral external IP addresses are allocated in order to:

  • Provide a third-party service with a consistent external IP address.
  • Monitor and filter egress traffic out of the Google Kubernetes Engine cluster.
0

Google Cloud now provides a managed NAT Gateway service - Cloud NAT.

This gateway can be used with a GKE cluster, which provides a stable public egress IP to all the pods inside it, which enables them to be whitelisted by third party service providers.

The example implementation for using Cloud NAT with GKE is provided here - https://cloud.google.com/nat/docs/gke-example

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.