1

I have a Kubernetes cluster (1.3.2) in the the GKE and I'd like to connect VMs and services from my google project which shares the same network as the cluster.

Is there a way for a VM that's internal to the subnet but not internal to the cluster itself to connect to the service without hitting the external IP?

I know there's a ton of things you can do to unambiguously determine the IP and port of services, such as the ENVs and DNS...but the clusterIP is not reachable outside of the cluster (obviously).

Is there something I'm missing? An important component to this is that this is meant to be a service "public" to the project, such that I don't know which VMs on the project will want to connect to the service (this could rule out loadBalancerSourceRanges). I understand the endpoint which the services actually wraps is the internal IP I can hit, but the only good way to get to that IP is though the Kube API or kubectl, both of which are not prod-ideal ways of hitting my service.

user1040625
  • 403
  • 1
  • 4
  • 11

1 Answers1

2

Check out my more thorough answer here, but the most common solution to this is to create bastion routes in your GCP project.

In the simplest form, you can create a single GCE Route to direct all traffic w/ dest_ip in your cluster's service IP range to land on one of your GKE nodes. If that SPOF scares you, you can create several routes pointing to different nodes, and traffic will round-robin between them.

If that management overhead isn't something you want to do going forward, you could write a simple controller in your GKE cluster to watch the Nodes API endpoint, and make sure that you have a live bastion route to at least N nodes at any given time.

GCP internal load balancing was just released as alpha, so in the future, kube-proxy on GCP could be implemented using that, which would eliminate the need for bastion routes to handle internal services.

Community
  • 1
  • 1
CJ Cullen
  • 5,452
  • 1
  • 26
  • 34
  • Thanks, CJ. Googling this, for whatever reason, was pretty difficult :) – user1040625 Aug 09 '16 at 20:45
  • Actually, a follow up question...is there a guarantee that node 0 (the first node spun up by k8s) will always exist assuming replicas are always set to 1 or more? I can see the need for a controller if that that isn't the case. – user1040625 Aug 09 '16 at 20:56
  • I don't think there is any guarantee on which nodes disappear when you scale down your cluster. And a node could just be unresponsive for some other reason, so the 2nd and 3rd options are definitely better (but more work). – CJ Cullen Aug 09 '16 at 21:11