K
Q

GKE/Istio: outside world cannot connect to service in private cluster

2/20/2019

I've created a private GKE cluster with Istio through the Cloud Console UI. The cluster is set up with VPC Peering to be able to reach another private GKE cluster in another Google Cloud Project.

I've created a Deployment (called website) with a Service in Kubernetes in the staging namespace. My goal is to expose this service to the outside world with Istio, using the Envoy proxy. I've created the necessary VirtualService and Gateway to do so, following this guide.

When running "kubectl exec ..." to access a pod in the private cluster, I can successfully connect to the internal IP address of the website service, and see the output of that service with "curl".

I have set up a NAT Gateway so pods in the private cluster can connect to the Internet. I confirmed this by curl-ing various non-Google web pages from within the website pod.

However, I can't connect to the website service from the outside, using the External IP of the istio-ingressgateway service, as the guide above mentions. Instead, curl-ing that External IP leads to a timeout.

I've put the full YAML config for all related resources in a private Gist, here: https://gist.github.com/marceldegraaf/0f36ca817a8dba45ac97bf6b310ca282

I'm wondering if I'm missing something in my config here, or if my use case is actually impossible?

-- Marcel de Graaf
google-kubernetes-engine
istio
kubernetes

Similar Questions

Kubernetes service running fine but unable to access from outside
Kubernetes nginx ingress periodically gives 404
502 Bad Gateway with Kubernetes Ingress
Does kubectl drain remove pod first or create pod first

2 Answers

2/20/2019

Looking at your Gist I suspect the problem lies in the joining up of the Gateway to the istio-ingressgateway.

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: website-gateway
  namespace: staging
  labels:
    version: v1
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"

In particular I'm not convinced the selector part is correct.

You should be able to do something like
kubectl describe po -n istio-system istio-ingressgateway-rrrrrr-pppp
to find out what the selector is trying to match in the Istio Ingress Gateway pod.

-- Paul Annetts
Source: StackOverflow
2/20/2019

From verifying all options, the only way to have the private GKE cluster with Istio to be exposed to externally is to use Cloud NAT.

Since the Master node within GKE is a managed service, there are current limits when using Istio with a private cluster. The only workaround that would accomplish your use case is to use Cloud NAT. I have also attached an article on how to get started using Cloud NAT here.

-- Jason
Source: StackOverflow