How do I specify a Kubernetes service as HTTP target for a Google Cloud task?

4/25/2020

I have a nodejs express server running on Google Kubernetes Engine, exposed as a NodePort service at some IP (say 10.0.20.20).

I would like to use this nodejs service as the handler for Google Cloud tasks, so I created the following task (using the Python library):

task = {
    'http_request': {
        'http_method': 'POST',
        'url': 'http://10.0.20.20/myendpoint',
        'body': payload
    }
}

The task is created successfully, however, it then gets stuck in the queue retrying forever. How can I set up my service so that it is reachable from Google Cloud tasks?

-- prvnsmpth
google-cloud-tasks
google-kubernetes-engine

1 Answer

4/28/2020

Depending on your scenario you want to achieve here is the recommended use of service exposure at GKE level.

I will assume you want to connect into that nodejs service from an instance on the same network as your GKE cluster nodes since you are using an RFC-1918 IP.

A nodeport can only use (as per now) a range from 30000 to 32767.

You can specify your own nodePort value in the 30000--32767 range. However, it's best to omit the field and let Kubernetes allocate a nodePort for you. This avoids collisions between Services.

So, the url you are using:

http://10.0.20.20/myendpoint

Is by default using port 80/tcp, and not one of the nodePort range I previously mentioned (30000 to 32767) and therefore, failing.

If you want to use only a pass-through internally from other instances on the same VPC and region, use a service type loadbalancer, if you want an intermediate services that handles HTTPS for you instead of your backend, use an internal ingress but keep in mind that this is still on beta and that you would need to provide your own SSL certificates as this is not compatible with Google Managed certs right now.

As a reminder, assuming you are using a stable GKE version cluster, internal loadbalancer service types are considered regional resources meaning you can only use them in the same subnet you create them with a few exceptions being VPN and/or interconnect into the same VPC and subnet region, this behavior will be optional starting from version 1.16 and up.

-- Frank
Source: StackOverflow