Cluster Configuration

GKE

Private Clusters

If you are using a private GKE cluster, you are required to create a firewall rule that allows the GKE operated api-server to communicate with the Linkerd control plane. This makes it possible for features such as automatic proxy injection to receive requests directly from the api-server.

In this example, we will use gcloud to simplify the creation of the said firewall rule.

Setup:

  1. CLUSTER_NAME=your-cluster-name
  2. gcloud config set compute/zone your-zone-or-region

Get the cluster MASTER_IPV4_CIDR:

  1. MASTER_IPV4_CIDR=$(gcloud container clusters describe $CLUSTER_NAME \
  2. | grep "masterIpv4CidrBlock: " \
  3. | awk '{print $2}')

Get the cluster NETWORK:

  1. NETWORK=$(gcloud container clusters describe $CLUSTER_NAME \
  2. | grep "^network: " \
  3. | awk '{print $2}')

Get the cluster auto-generated NETWORK_TARGET_TAG:

  1. NETWORK_TARGET_TAG=$(gcloud compute firewall-rules list \
  2. --filter network=$NETWORK --format json \
  3. | jq ".[] | select(.name | contains(\"$CLUSTER_NAME\"))" \
  4. | jq -r '.targetTags[0]' | head -1)

The format of the network tag should be something like gke-cluster-name-xxxx-node.

Verify the values:

  1. echo $MASTER_IPV4_CIDR $NETWORK $NETWORK_TARGET_TAG
  2. # example output
  3. 10.0.0.0/28 foo-network gke-foo-cluster-c1ecba83-node

Create the firewall rules for proxy-injector and tap:

  1. gcloud compute firewall-rules create gke-to-linkerd-control-plane \
  2. --network "$NETWORK" \
  3. --allow "tcp:8443,tcp:8089" \
  4. --source-ranges "$MASTER_IPV4_CIDR" \
  5. --target-tags "$NETWORK_TARGET_TAG" \
  6. --priority 1000 \
  7. --description "Allow traffic on ports 8443, 8089 for linkerd control-plane components"

Finally, verify that the firewall is created:

  1. gcloud compute firewall-rules describe gke-to-linkerd-control-plane