I have been trying to reach my Google Compute instance on Compute Engine from a pod in a Kubernetes cluster.

Using curl http://{INTERNAL_IP}:{PORT}/

I get: curl: (7) Failed to connect to port 8080: Connection timed out

What are the reasons I could not reach my google compute machine from my Kubernetes pod?

They both share the same region, could it be a permission issue?

  • it's complicated suggest you to ssh to the node and do some testing like "ip addr" and "ip route" and"sudo iptables-save" and try to match the route – Alioua Dec 17 '18 at 21:37
  • just be sure that your instance has a service exposed on the port 8080 and the firewall rules allow the traffic internally and the instance should be in the same zone of your cluster – Alioua Dec 17 '18 at 21:58
  • my compute instance can be reachable from a pod in a separate kubernetes cluster, so i do not believe it is an issue with the compute instance, but something about the pod's configurations/permissions. – Geoff Paul Bremner Dec 17 '18 at 22:17
  • you mention sometimes is it intermittent ? The pod will use the service account and scopes to make any request outside the node, if you suspect permission issue compare both cluster Service account permission – Alioua Dec 18 '18 at 0:54
  • it is not intermittent; no pods in this cluster can reach any of my Google Compute Engine instances via CURL. However in my other cluster, which is created the same way, pods CAN reach the same Compute Engine instances via curl on the internal IP. – Geoff Paul Bremner Dec 20 '18 at 17:09

I have solved the issue by adding a firewall rule in GCP. What I did was create an Ingress firewall rule for all my compute instance VMs for the kubernetes cluster IP. This option can be found under VPC Networks > Firewall Rules.


It's possible that you have not configured IP masquerading. This is a form of NAT where masquerading node/pod IP addresses when sending traffic to destinations outside the cluster node’s IP and the Cluster IP range. For more information look at the following documentation

  • IP masq mostly only applies when a pod wants to reach the internet, not within a VPC – Tim Hockin Feb 28 '19 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.