如何在谷歌容器引擎中为Kubernetes集群创建防火墙

Question

This may be an extremely simple question, but I can't seem to figure out how to only allow my kubernetes cluster to be accessible ONLY from my office IP.

In my firewall rules I see my rules for the gke nodes to be 2 internal ips and my office ip.

I also see a firewall rule for an external ip range that I don't see in my external IP addresses. That IP address also doesn't appear in my load balancer IPs...

Finally I have a loadbalancing firewall rule that allows the external IP ranges from the load balancing tab, which are my kubernetes ingress rules.

Long story short, how do I only allow my kubernetes cluster to be only accessible from my office IP?

Answer 1

This isn't currently possible in Google Container Engine.

You don't see any firewall rules for your cluster control plane because it isn't running inside your cloud project. Therefore the endpoint for your cluster won't show up in your networking views and you cannot add firewall rules to restrict access to it.

This is a shortcoming that the team is aware of and we hope to be able to provide a solution for you in the future.