Each time I try to use network tags to restrict access instead to use IP address (specially with scalable instances) I get timeout.
I try the following : Compute instances -> Kubernetes Loadbalancer -> containers cluster If I set the same network tags on my source (compute instances) and Firewall's source network tag, I get no response. But if I use source IP, no problem connectivity. I'm not sure if problem is not realated to AMI, service account or compute instances and Kubernetes ressources communications... thanks for you help
It sounds like you're hitting an edge case bug where if you tag your GCE instances and GKE nodes with the same tag, the firewall rule gets confused (if I'm reading your question correctly). Can you assign different tags to the GCE instances and GKE nodes and try to create a firewall rule using those tags?