GKE Networking Guide

Complete guide to networking in Google Kubernetes Engine (GKE), covering Pods, Services, DNS, load balancing, security, and IP address management.

Networking Overview

Key Networking Concepts

Concept	Description
Pod Network	Each Pod gets a unique IP address, Pods can communicate directly
Services	Stable network endpoint for a set of Pods
Ingress	HTTP(S) routing to Services
Gateway API	Next-gen traffic management (Layer 4 & 7)
Network Policies	Firewall rules for Pod-to-Pod traffic
Dataplane V2	eBPF-based networking with built-in policy enforcement

---

Services

Service Types

ClusterIP Service

Default service type. Provides internal-only access within the cluster.

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  type: ClusterIP  # Default
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080

LoadBalancer Service

Exposes service externally using a cloud load balancer.

apiVersion: v1
kind: Service
metadata:
  name: my-external-service
spec:
  type: LoadBalancer
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080
  # Restrict source IPs
  loadBalancerSourceRanges:
  - 10.0.0.0/8
  - 192.168.1.0/24

Service Discovery

Services are discoverable via DNS:

• Same namespace: my-service
• Cross namespace: my-service.other-namespace
• FQDN: my-service.namespace.svc.cluster.local

---

Load Balancing

Load Balancer Types

Load Balancer Type	Layer	Use Case
External Network LB	L4	TCP/UDP services, gaming, IoT
External HTTP(S) LB	L7	Web apps, APIs, microservices
Internal TCP/UDP LB	L4	Internal TCP services
Internal HTTP(S) LB	L7	Internal APIs, service mesh

Internal Load Balancer

apiVersion: v1
kind: Service
metadata:
  name: internal-service
  annotations:
    networking.gke.io/load-balancer-type: "Internal"
spec:
  type: LoadBalancer
  selector:
    app: internal-app
  ports:
  - port: 80
    targetPort: 8080

---

Gateway API

Gateway API is the next-generation traffic management for Kubernetes.

Gateway Example

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: external-gateway
spec:
  gatewayClassName: gke-l7-global-external-managed
  listeners:
  - name: http
    protocol: HTTP
    port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app-route
spec:
  parentRefs:
  - name: external-gateway
  rules:
  - matches:
    - path:
        value: /api
    backendRefs:
    - name: api-service
      port: 80
  - matches:
    - path:
        value: /
    backendRefs:
    - name: frontend-service
      port: 80

Gateway API Features

Feature	Description
Path-based routing	Route by URL path
Host-based routing	Route by hostname
Header matching	Route by HTTP headers
Traffic splitting	Canary deployments, A/B testing
TLS termination	HTTPS with managed certificates

---

Network Policies

Control Pod-to-Pod communication with Network Policies.

Default Deny Policy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}  # Applies to all pods
  policyTypes:
  - Ingress
  - Egress

Allow Specific Traffic

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

Network Policy Best Practices

1. Start with default deny - Block all traffic, then allow what's needed
2. Use namespace selectors - Isolate namespaces from each other
3. Enable logging - Audit allowed and denied connections
4. Test policies - Verify before applying to production

---

GKE Dataplane V2

eBPF-based networking dataplane with enhanced features.

Dataplane V2 Benefits

Benefit	Description
Built-in policy enforcement	Native NetworkPolicy support
Observability	Hubble for traffic visibility
Performance	Optimized eBPF data path
Kubernetes-native logging	Network policy logs in Cloud Logging

Enable Dataplane V2

gcloud container clusters create my-cluster \
    --enable-dataplane-v2 \
    --region us-central1

---

IP Address Management

IP Address Planning

IP Planning Considerations

Component	Recommendation
Nodes	/24 per 250 nodes
Pods	/14 for large clusters (1M+ Pods)
Services	/20 for most clusters
Pod density	Default 110 Pods/node

VPC-Native Clusters

gcloud container clusters create my-cluster \
    --enable-ip-alias \
    --cluster-ipv4-cidr=/14 \
    --services-ipv4-cidr=/20 \
    --region us-central1

---

Multi-Cluster Networking

Multi-Cluster Services (MCS)

Multi-cluster Services enables:

• Cross-cluster service discovery
• Automatic health-aware failover
• Global DNS resolution

---

DNS Configuration

NodeLocal DNSCache

Improve DNS performance by caching queries locally on each node.

Enable NodeLocal DNSCache:

gcloud container clusters update my-cluster \
    --update-addons=NodeLocalDNS=ENABLED

Cloud DNS for GKE

Use Cloud DNS for improved scalability and reliability:

gcloud container clusters update my-cluster \
    --cluster-dns=clouddns \
    --cluster-dns-scope=vpc

---

Quick Reference

Common Networking Commands

# View services
kubectl get services -A

# View endpoints
kubectl get endpoints

# View network policies
kubectl get networkpolicies -A

# Test connectivity
kubectl run test --rm -it --image=busybox -- wget -qO- http://service-name

# View DNS resolution
kubectl run test --rm -it --image=busybox -- nslookup service-name

Troubleshooting Checklist

Issue	Check
Service unreachable	Endpoints exist, Pod labels match selector
DNS not resolving	kube-dns running, service exists
Traffic blocked	Network policies, firewall rules
Load balancer pending	Quota, firewall, health checks

---

Last updated: December 2025