gke-service-networking

GKE Service Networking Skill

This skill provides workflows for exposing applications running on GKE securely to the internet or internal networks.

Workflows

1. Configure Gateway API (Recommended)

The Gateway API is the modern way to manage routing in Kubernetes.

Prerequisites: Gateway API must be enabled on the cluster (enabled by default in GKE 1.24+).

Example Gateway Manifest:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: {gateway_name}
  namespace: {namespace}
spec:
  gatewayClassName: gke-l7-global-external-managed # GKE managed external L7 load balancer
  listeners:
    - name: http
      protocol: HTTP
      port: 80

Example HTTPRoute Manifest:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {route_name}
  namespace: {namespace}
spec:
  parentRefs:
    - name: {gateway_name}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: {service_name}
          port: 80

2. Configure Standard GKE Ingress

Use standard Ingress for simpler use cases or legacy setups.

Example Ingress Manifest:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {ingress_name}
  namespace: {namespace}
  annotations:
    kubernetes.io/ingress.class: "gce"
spec:
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {service_name}
                port:
                  number: 80

3. Secure with Cloud Armor

Cloud Armor provides WAF and DDoS protection.

Enable Cloud Armor via BackendConfig:

1. Create a Security Policy in Cloud Armor (usually via gcloud or Terraform).
2. Reference it in a BackendConfig in GKE.

Example BackendConfig:

apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: {backend_config_name}
  namespace: {namespace}
spec:
  securityPolicy:
    name: {security_policy_name}