---
title: "GKE networking and isolation"
chapter: "05"
---

# GKE networking and isolation

GKE networking connects Pods, Services, Google Cloud load balancers, VPCs, the
internet, and hybrid systems.

## Address plan

Plan non-overlapping primary node ranges and secondary Pod/Service ranges.
Estimate maximum Pods per node, cluster growth, peering, Shared VPC, hybrid
networks, and future clusters. Use flexible Pod CIDR features where appropriate,
but do not depend on late rescue from a poor IP plan.

## Private design

Private nodes have no external IP addresses. Use Cloud NAT for controlled
outbound internet access and Private Google Access for Google APIs where
appropriate. Restrict control-plane access with DNS-based endpoints, authorized
networks, or private access according to the current GKE model.

## Traffic controls

VPC firewall rules control virtual-machine and network-level flows. Kubernetes
NetworkPolicy controls Pod-level communication when enforcement is enabled.
GKE Dataplane V2, based on eBPF, is the recommended dataplane and is the
Autopilot default.

Start with default deny, then allow required DNS, identity metadata, ingress,
monitoring, and service-to-service paths. Test policies before enforcement.

## Exposing services

Use Gateway API or Ingress to provision application load balancing. Use
`Service` type `LoadBalancer` for L4 traffic. Put Cloud Armor in front of public
HTTP services. Use Cloud DNS for names and Certificate Manager or managed
certificates for TLS.

Official source: [GKE networking best practices](https://cloud.google.com/kubernetes-engine/docs/best-practices/networking).