--- id: gh-gke-networking name: "gke-networking" url: https://skills.yangsir.net/skill/gh-gke-networking author: google domain: cloud-infra tags: ["gke", "kubernetes", "networking", "vpc", "private-cluster"] install_count: 6500 rating: 4.50 (120 reviews) github: https://github.com/google/skills/tree/main/skills/cloud/gke-networking --- # gke-networking > 该 Skill 提供 GKE 集群网络配置的最佳实践指南，涵盖私有集群、VPC-native 模式、IP 规划等关键设置，帮助用户快速搭建安全高效的 Kubernetes 网络环境，减少配置错误和排障时间。 **Stats**: 6,500 installs · 4.5/5 (120 reviews) ## Before / After 对比 ### GKE 集群网络配置耗时 **Before**: 没有此技能之前，用户需要手动查阅 GKE 网络文档、反复试错才能完成集群网络配置，包括私有节点、VPC-native、IP 规划等，耗时且容易出错。 **After**: 此 Skill 提供 Golden Path 默认配置，用户可直接使用最佳实践，快速完成私有集群、VPC-native 等设置，减少配置错误，极大缩短配置时间。 | Metric | Before | After | Change | |---|---|---|---| | 配置时间 | 60分钟 | 10分钟 | -83% | ## Readme # GKE Networking This reference covers networking configuration for GKE clusters. The golden path enforces private, VPC-native clusters with Dataplane V2. > **MCP Tools:** `get_cluster`, `update_cluster`, `apply_k8s_manifest`, > `get_k8s_resource` ## Golden Path Networking Defaults Setting | Golden Path Value | Day-0/1 | Notes -------------------------------------------------------------------- | ---------------------------------- | ------- | ----- `privateClusterConfig.enablePrivateNodes` | `true` | Day-0 | Nodes have no public IPs `masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled` | `true` | Day-0 | Control plane only reachable via private endpoint or DNS `controlPlaneEndpointsConfig.dnsEndpointConfig.allowExternalTraffic` | `true` | Day-0 | Allows DNS-based access from outside VPC `networkConfig.datapathProvider` | `ADVANCED_DATAPATH` (Dataplane V2) | Day-0 | eBPF-based, built-in Network Policy `networkConfig.dnsConfig.clusterDns` | `CLOUD_DNS` | Day-0 | Managed DNS, more reliable than kube-dns `networkConfig.enableIntraNodeVisibility` | `true` | Day-1 | VPC Flow Logs for intra-node traffic `ipAllocationPolicy.autoIpamConfig.enabled` | `true` | Day-0 | Automatic IP range management `ipAllocationPolicy.createSubnetwork` | `true` | Day-0 | Auto-create dedicated subnet `defaultMaxPodsConstraint.maxPodsPerNode` | `48` | Day-0 | Conservative default; 110 for high density ## Private Cluster Access Patterns The golden path creates a private cluster. Users access it via: 1. **DNS endpoint (default)**: `allowExternalTraffic: true` enables access via the cluster's DNS endpoint from outside the VPC. No VPN required. 2. **Private endpoint**: Direct access from within the VPC or via Cloud VPN/Interconnect. 3. **Authorized networks**: Add specific CIDRs to `masterAuthorizedNetworksConfig` for IP-based access control. ```bash # Access private cluster via DNS endpoint (golden path default) gcloud container clusters get-credentials {cluster_name} \ --region {region} --dns-endpoint \ --quiet # Access via private endpoint (from within VPC) gcloud container clusters get-credentials {cluster_name} \ --region {region} --internal-ip \ --quiet ``` ## Bring-Your-Own VPC/Subnet If the customer has existing network infrastructure: ```bash gcloud container clusters create-auto {cluster_name} \ --region {region} \ --network {vpc_name} \ --subnetwork {subnet_name} \ --cluster-secondary-range-name {pod_range} \ --services-secondary-range-name {svc_range} \ --enable-private-nodes \ --enable-master-authorized-networks \ --quiet ``` > **Day-0 Warning**: VPC, subnet, and IP ranges cannot be changed after cluster > creation. ## VPC-Native Mode Benefits VPC-native clusters route traffic natively using GCP Alias IP ranges. Key benefits to cover: 1. **Scalability**: Traffic routes natively inside the VPC, bypassing the need for custom routes and avoiding custom route limit bottlenecks. 2. **Direct VPC Integration**: Direct resource integration across GCP networks without complex bridging or routing tunnels. 3. **Avoiding IP Exhaustion**: Supports discontiguous IP ranges and optimizes allocation, reducing the risk of exhausting subnet IP ranges. ## IP Planning | Resource | Golden Path | Notes | | ------------- | ------------ | ------------------------------------------ | | Pod CIDR | `/17` (auto) | ~32K pod IPs; size based on maxPodsPerNode | | Service CIDR | `/20` (auto) | ~4K service IPs | | Node subnet | auto-created | /20 recommended for growth | | Max pods/node | 48 | Each node gets a /25 pod range; set to 110 | : : : for /24 per node : **Pod CIDR sizing rule of thumb:** - `maxPodsPerNode=48` -> each node uses a `/25` (128 IPs) from pod CIDR - `maxPodsPerNode=110` -> each node uses a `/24` (256 IPs) from pod CIDR - Larger maxPodsPerNode = fewer nodes fit in a given CIDR ## Egress - Default: nodes use Cloud NAT for outbound internet access (private nodes have no public IPs) to allow private nodes to reach the internet without public IP exposure. - For static egress IPs: configure Cloud NAT with manual IP allocation to maintain a consistent source IP for external allowlists or partner firewalls. - For restricted egress: route through a firewall appliance via custom routes to inspect and filter outbound traffic according to organization security policies. ## Network Policy Dataplane V2 (golden path) provides built-in Network Policy enforcement — no additional addon needed. Apply default-deny per namespace, then allow specific flows. > See the `gke-workload-security` skill for default-deny policy and the > `gke-multitenancy` skill for per-team allow policies. --- *Source: https://skills.yangsir.net/skill/gh-gke-networking* *Markdown mirror: https://skills.yangsir.net/api/skill/gh-gke-networking/markdown*