0

I have been trying to reach my Google Compute instance on Compute Engine from a pod in a Kubernetes cluster.

Using curl http://{INTERNAL_IP}:{PORT}/

I get: curl: (7) Failed to connect to 10.0.0.7 port 8080: Connection timed out

What are the reasons I could not reach my google compute machine from my Kubernetes pod?

They both share the same region, could it be a permission issue?

5
  • it's complicated suggest you to ssh to the node and do some testing like "ip addr" and "ip route" and"sudo iptables-save" and try to match the route
    – Alioua
    Dec 17, 2018 at 21:37
  • just be sure that your instance has a service exposed on the port 8080 and the firewall rules allow the traffic internally and the instance should be in the same zone of your cluster
    – Alioua
    Dec 17, 2018 at 21:58
  • my compute instance can be reachable from a pod in a separate kubernetes cluster, so i do not believe it is an issue with the compute instance, but something about the pod's configurations/permissions. Dec 17, 2018 at 22:17
  • you mention sometimes is it intermittent ? The pod will use the service account and scopes to make any request outside the node, if you suspect permission issue compare both cluster Service account permission
    – Alioua
    Dec 18, 2018 at 0:54
  • it is not intermittent; no pods in this cluster can reach any of my Google Compute Engine instances via CURL. However in my other cluster, which is created the same way, pods CAN reach the same Compute Engine instances via curl on the internal IP. Dec 20, 2018 at 17:09

2 Answers 2

1

I have solved the issue by adding a firewall rule in GCP. What I did was create an Ingress firewall rule for all my compute instance VMs for the kubernetes cluster IP. This option can be found under VPC Networks > Firewall Rules.

-1

It's possible that you have not configured IP masquerading. This is a form of NAT where masquerading node/pod IP addresses when sending traffic to destinations outside the cluster node’s IP and the Cluster IP range. For more information look at the following documentation

1
  • IP masq mostly only applies when a pod wants to reach the internet, not within a VPC
    – Tim Hockin
    Feb 28, 2019 at 18:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .