GKE Networking

MCP Tools:

get_cluster

,

update_cluster

,

apply_k8s_manifest

,

get_k8s_resource

Golden Path Networking Defaults

privateClusterConfig.enablePrivateNodes

true

masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled

true

controlPlaneEndpointsConfig.dnsEndpointConfig.allowExternalTraffic

true

networkConfig.datapathProvider

ADVANCED_DATAPATH

networkConfig.dnsConfig.clusterDns

CLOUD_DNS

networkConfig.enableIntraNodeVisibility

true

networkConfig.gatewayApiConfig.channel

CHANNEL_STANDARD

ipAllocationPolicy.autoIpamConfig.enabled

true

ipAllocationPolicy.createSubnetwork

true

defaultMaxPodsConstraint.maxPodsPerNode

48

Private Cluster Access Patterns

1. DNS endpoint (default):

   allowExternalTraffic: true

   enables access via the cluster's DNS endpoint from outside the VPC. No VPN required.
2. Private endpoint: Direct access from within the VPC or via Cloud VPN/Interconnect.
3. Authorized networks: Add specific CIDRs to

   masterAuthorizedNetworksConfig

   for IP-based access control.

# Access private cluster via DNS endpoint (golden path default)
gcloud container clusters get-credentials <CLUSTER_NAME> \
  --region <REGION> --dns-endpoint \
  --quiet

# Access via private endpoint (from within VPC)
gcloud container clusters get-credentials <CLUSTER_NAME> \
  --region <REGION> --internal-ip \
  --quiet

Bring-Your-Own VPC/Subnet

gcloud container clusters create-auto <CLUSTER_NAME> \
  --region <REGION> \
  --network <VPC_NAME> \
  --subnetwork <SUBNET_NAME> \
  --cluster-secondary-range-name <POD_RANGE> \
  --services-secondary-range-name <SVC_RANGE> \
  --enable-private-nodes \
  --enable-master-authorized-networks \
  --quiet

Day-0 Warning: VPC, subnet, and IP ranges cannot be changed after cluster creation.

IP Planning

/17

/20

• maxPodsPerNode=48

  -> each node uses a

  /25

  (128 IPs) from pod CIDR

• maxPodsPerNode=110

  -> each node uses a

  /24

  (256 IPs) from pod CIDR
• Larger maxPodsPerNode = fewer nodes fit in a given CIDR

Ingress

gatewayApiConfig.channel: CHANNEL_STANDARD

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: external-http
spec:
  gatewayClassName: gke-l7-global-external-managed
  listeners:
  - name: http
    protocol: HTTP
    port: 80

• gke-l7-regional-external-managed

  — regional external

• gke-l7-rilb

  — internal load balancer
• Istio service mesh — for advanced traffic management, mTLS

Egress

• Default: nodes use Cloud NAT for outbound internet access (private nodes have no public IPs)
• For static egress IPs: configure Cloud NAT with manual IP allocation
• For restricted egress: route through a firewall appliance via custom routes

Network Policy

See the

gke-security

skill for default-deny policy and the

gke-multitenancy

skill for per-team allow policies.

Cloud Armor (Recommended for Public-Facing Services)

BackendConfig

# 1. Create BackendConfig referencing your Cloud Armor policy
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: my-backend-config
spec:
  securityPolicy:
    name: my-cloud-armor-policy
---
# 2. Annotate your Service
# cloud.google.com/backend-config: '{"default": "my-backend-config"}'

SSL, Container-Native LB, and PSC

• Google-managed SSL certificates: Use

  ManagedCertificate

  CRD with Gateway API. Auto-provisions and renews.
• Container-native LB: Enabled by default on VPC-native clusters (golden path). Targets pods via NEGs, bypassing iptables. Annotation:

  cloud.google.com/neg: '{"ingress": true}'

  .
• Private Service Connect (PSC): Use

  ServiceAttachment

  CRD to expose services across VPCs without peering.