Set static IP address to egress traffic

[hadi-getox]

Hello,

I would like to set a static ip address to some egress traffic coming out from GKE autopilot to some third party managed service i.e. MongodbAtlas. 

there is an option to set that in cloud run but could not find a documentation explaining this in GKE:

https://cloud.google.com/run/docs/configuring/static-outbound-ip

[Arekkusu]

The short answer is this is possible using Cloud NAT with a fixed IP. See public documentation:

https://cloud.google.com/nat/docs/public-nat
https://cloud.google.com/nat/docs/nat-rules-overview
https://cloud.google.com/nat/docs/gke-example

At least this would be the recommended / easiest solution using a managed GCP offering.
Note that GKE doesn't support node VM can't have a fixed (public or private) IP.

[Marvin_Lucero]

Hi @hadi-getox ,

In addition to @Arekkusu 's answer, one way to achieve this is by utilizing Cloud NAT and the IP Masquerade Agent. Google Cloud NAT enables control over egress traffic from your VPC, using static IP addresses. Additionally, the IP Masquerade Agent, deployed as a DaemonSet on GKE nodes, allows you to customize outbound traffic's source IP address for specific pods or namespaces. This combination provides a way to manage static IPs for egress traffic in GKE Autopilot.

[mks89]

@Marvin_Lucero 

After Reading the IP Masquerading Agent docs, my understanding is, the Source IP of the packets leaving the cluster -- can be set to either PodIP or the NodeIP.

Is it possible to set a reserved private IP as the source IP via IP-Masq-agent?

Cheers,

/M

[Igoris]

Were you able to find a solution for this? I tried to setup a Cloud NAT for my GKE Autopilot cluster. But seems that GKE Autopilot does not allow to setup custom Cloud NAT, at least for me it didn't work.

[hadi-getox]

Team, I was following the below documentation with no success:

https://cloud.google.com/kubernetes-engine/docs/how-to/egress-nat-policy-ip-masq-autopilot

Did it work for you?

[jrowinski]

I finally got this to work. I have a GKE Autopilot cluster running. You need to disable the External IPs from your nodes otherwise they will not route via the Cloud NAT. Private Nodes -> Enabled

Now any new nodes that join the cluster from your workloads will only have a local internal IP and will be using your newly created Cloud NAT. GEEEEEEZE that took too long to figure out. Hope this saves someone time that I had dont have right now 😛 

[Digitaldaz]

Hi, do all the existing ingresses to the pods etc still work when you have enabled private nodes?