(Cross-posted to the Google "gce-discussion" support board)
I've been worrying (and posting, on Stack Overflow, gce-discussion, and the Tomcat Users list server) about calls from instance group nodes to web services carrying the external IP address of the individual node (which makes it problematical to restrict the web services by calling IP).
Then I saw something called "Cloud NAT."
If I've got Cloud NAT set up, do web service calls from my instance group show the IP address set in the NAT?
And that brings up another question that's been fermenting in my mind for a few days now: our instance group nodes are currently set to have ephemeral external IP addresses. Is there any real reason why they should have external IP addresses at all? Can I, for example, still get a terminal session through the web-to-ssh portal if there's no external IP address? Can I likewise use "gcloud compute scp"? I think possibly my original reason for having external IP addresses had to do accessing them from the ssh and scp on my Mac (which is more trouble than it's worth in most cases anyway).