如何为 GKE 设置防火墙

Question

I can't use the external IP of the GKE I deployed it a success by Jenkins and below is:

when i run " kubectl get service":

NAME         TYPE           CLUSTER-IP    EXTERNAL-IP    PORT(S)          AGE
hello        LoadBalancer   10.92.14.31   34.170.30.56   8080:31110/TCP   2d21h

I checked my deployment.yaml and i think no problem with it bellow is file:

    spec:
  containers:
  - name: hello
    image: azmassage/hello:latest
    imagePullPolicy: Always
    ports:
    - containerPort: 8080
      name: hello

    ---
    apiVersion: v1
    kind: Service
    metadata:
    name: hello
    spec:
    ports:
    - protocol: TCP
    port: 8080
    nodePort: 31110
    selector:
    app: hello
    tier: hello
    type: LoadBalancer
    Footer

and I think this is the problem with firewalls after I create the firewall rule:

I can't connect and use it bellow is ms test:

admin_@cloudshell:~$ curl http://34.170.30.56:8080
curl: (7) Failed to connect to 34.170.30.56 port 8080: Connection refused

Answer 1

When a cluster or its resources (including Services and Ingresses) are created, Google Kubernetes Engine automatically generates and manages firewall rules.

For more information, please check Automatically created firewall rules in the Google Kubernetes Engine documentation.

A VPC network and a set of components that define what the rule does are specified when creating a VPC firewall rule. The parts empower you to focus on specific sorts of traffic, in light of the traffic's convention, objective ports, sources, and objections. See components of a firewall for more details.

At the point when you make a LoadBalancer Administration, GKE makes a VPC firewall rule relating to the Help. The following characteristics are found in each firewall rule:

Since the load balancer is a part of your network, you can make an ingress firewall rule to allow or deny any source IP with a " tag "

Refer this document for more information

There is a similar query addressed in this stack link

Answer 2

I'm not sure, but maybe make sense to open 31110 port on the firewall and check it with curl?