GKE networking and isolation

GKE networking connects Pods, Services, Google Cloud load balancers, VPCs, the internet, and hybrid systems.

Address plan

Plan non-overlapping primary node ranges and secondary Pod/Service ranges. Estimate maximum Pods per node, cluster growth, peering, Shared VPC, hybrid networks, and future clusters. Use flexible Pod CIDR features where appropriate, but do not depend on late rescue from a poor IP plan.

Private design

Private nodes have no external IP addresses. Use Cloud NAT for controlled outbound internet access and Private Google Access for Google APIs where appropriate. Restrict control-plane access with DNS-based endpoints, authorized networks, or private access according to the current GKE model.

Traffic controls

VPC firewall rules control virtual-machine and network-level flows. Kubernetes NetworkPolicy controls Pod-level communication when enforcement is enabled. GKE Dataplane V2, based on eBPF, is the recommended dataplane and is the Autopilot default.

Start with default deny, then allow required DNS, identity metadata, ingress, monitoring, and service-to-service paths. Test policies before enforcement.

Exposing services

Use Gateway API or Ingress to provision application load balancing. Use Service type LoadBalancer for L4 traffic. Put Cloud Armor in front of public HTTP services. Use Cloud DNS for names and Certificate Manager or managed certificates for TLS.

Official source: GKE networking best practices.