Search code examples
kubernetesgoogle-cloud-platformnetworkingkubernetes-servicegoogle-vpc

Connection error beetwen shared vpc and vpc peering

I have this architecture in GCP.

Network project: 2 VPC, dev and pro, with two subnets each one. Subnet A is in europe-west1 and subnet B is in us-central1. The same in pro VPC. Both VPC are shared to other projects and I have a GKE cluster on each other project; so I have one GKE cluster in subnet A in VPC dev, one GKE cluster in subnet B in VPC dev and the same in pro VPC.

I have other project(project B) with some tools like Grafana, vault etc with other vpc and a subnet in europe-west1 which I have connected to dev VPC by VPC peering. In this project, I have GKE clusters too. My issue is, if I want to connect from project B to any GKE cluster in dev VPC, if I try to connect with subnet A works fine but with subnet B it doesn't and I don't know why. I have tried creating firewall rules but it doesn't work, even with firewall rules that allow all the traffic and all the ports.

Edit:

Now I can ping from GKE cluster in project B to a pod or node in subnet B but I can't access an Internal IP load balancer in subnet B (I have the same service in subnet A and it works fine). I'm trying with firewall rules that allows all the in/out traffic and all the ports but still not working

My architecture are this one:

enter image description here

My issue now is I can curl (for example) from GKE cluster 5 to an internal Load Balancer service in GKE cluster 1 and 3 but I can't to GKE cluster 2 and 4.

This is my service, it works because from another pod inside the cluster, curl works

apiVersion: v1
kind: Service
metadata:
  annotations:
    networking.gke.io/load-balancer-type: Internal
  name: prometheus
  namespace: monitoring
spec:
  ports:
  - name: http
    port: 9090
    protocol: TCP
    targetPort: 9090
  selector:
    app: prometheus
    prometheus: prometheus-kube-prometheus-prometheus
  sessionAffinity: None
  type: LoadBalancer

Edit: I uploaded the image from network tests:

enter image description here

Thanks

Solution

  • Finally I found the solution. The Load Balancer needs this annotation:

    networking.gke.io/internal-load-balancer-allow-global-access: "true"

    I tried it and it works

    Thanks to all