NAT Pod IP to Node IP on GKE GCP or alternative solutions?

[ishanC]

Here's my problem. My GKE GCP node IP addresses have access to an on premise network(private subnet) using ipsec/vpn and on premise firewall rules but my pod IP addresses do not. I want my traffic going from pods to use one of the acceptable node source IP addresses. How can I achieve that? I know IP masquerading is there, but will it work when my destination address is another private subnet range reachable via VPN/IPSeC ? Are there any other solution to achieve it?

[avinashjha · Accepted solution]

@ishanC 
When packets are sent to private network within VPC (or onprem connected via VPN), your cluster does not masquerade IP address sources and preserves source Pod IP addresses. 
To change this behaviour update the `ip-masq-agent` config map and under `nonMasqueradeCIDRs` remove your onprem subnet range. 
Now when the packets are send to those IP address destination, cluster will use the Node IP address