Question

Your team runs a VPC-native GKE cluster with a Pod secondary range of 10.60.0.0/14. Pods must communicate with an on-premises database at 172.16.5.10 reachable over Cloud Interconnect. The on-premises firewall only permits traffic sourced from the cluster's node subnet (10.10.0.0/24). Currently, connections from Pods to the on-premises database are being dropped because the on-premises firewall sees the Pod IP addresses as the source. What is the correct way to resolve this while keeping intra-cluster and Google API traffic unmasqueraded?

Accepted Answer

Deploy the ip-masq-agent DaemonSet and configure a nonMasqueradeCIDRs list that includes the Pod, Service, and Google API ranges, so that only traffic to on-premises destinations is SNATed to the node IP.

Answer

Add a custom static route in the VPC directing 172.16.5.10/32 through the Cloud Router, which will automatically rewrite the Pod source addresses to the node subnet.

Answer

Enable Private Google Access on the node subnet so Pod traffic to on-premises is translated to the subnet's primary range.

Answer

Configure Cloud NAT for the Pod secondary range so that Pod egress to on-premises appears to come from the node subnet.