Question

Your team deploys a private GKE cluster where nodes have only internal IP addresses. The application pods must pull container images from an external public registry (not Artifact Registry) and call a third-party payment API over the public internet. Cluster creation succeeds, but pods fail to pull the external images and cannot reach the payment API. What is the correct way to enable this outbound internet connectivity?

Accepted Answer

Configure Cloud NAT for the region and subnet used by the cluster so private nodes can initiate outbound connections to the internet.

Answer

Assign external IP addresses to the GKE nodes so they can reach the internet directly.

Answer

Enable Private Google Access on the node subnet to route the traffic to external endpoints.

Answer

Create a Private Service Connect endpoint targeting the external registry and payment API.