I have an instance that is on an internal subnet with IP

I have a kubernetes service defined as:

mysql           ExternalName   <none>   3306/TCP       151d

However strangely, if I set a firewall rule to only allow or to the instance (at, it won't connect. It's as if the k8s service is gaining access to the subnet by some other means (NAT?)?

What firewall rule do I apply to allow access? I do not want to have as the source - as it is currently.

When the firewall rule was, the tshark dump is:

chris@mysql8-book-1-vm:~$ sudo tshark -f "tcp port 3306" -i any
Running as user "root" and group "root". This could be dangerous.
Capturing on 'any'
    1 0.000000000 →  TCP 76 51818 → 3306 [SYN] Seq=0 Win=28400 Len=0 MSS=1420 SACK_PERM=1 TSval=2402747230 TSecr=0 WS=128
    2 0.000055238 →  TCP 76 3306 → 51818 [SYN, ACK] Seq=0 Ack=1 Win=28160 Len=0 MSS=1420 SACK_PERM=1 TSval=257905306 TSecr=2402747230 WS=128
    3 0.001203683 →  TCP 68 51818 → 3306 [ACK] Seq=1 Ack=1 Win=28416 Len=0 TSval=2402747232 TSecr=257905306
    4 0.001685970 →  MySQL 146 Server Greeting proto=10 version=8.0.16
    5 0.002183066 →  TCP 68 51818 → 3306 [ACK] Seq=1 Ack=79 Win=28416 Len=0 TSval=2402747233 TSecr=257905307
    6 10.006731817 →  TCP 68 3306 → 51818 [FIN, ACK] Seq=79 Ack=1 Win=28160 Len=0 TSval=257907808 TSecr=2402747233
    7 10.050067244 →  TCP 68 51818 → 3306 [ACK] Seq=1 Ack=80 Win=28416 Len=0 TSval=2402757279 TSecr=257907808
  • Try Network Policies to allow/restrict the access. Alternatively maybe istio? – Crou Jul 1 '19 at 15:32

If I understand it correctly, you have a GKE service running, and you would like other instances within the to access your service.

One way of achieving it via FW rules is to create an ingress rule with source range and target tag the GKE nodes network tags or alternatively the destination service account used by GKE, specifying port and protocol (in your case, TCP 3306).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.