Your organization's application is running on a VPC-native GKE Standard cluster with public IP addresses. You need to configure access to the remote address range 35.100.0.0/16 through Cloud NAT…

Question

Options

• AConfigure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Include the 35.100.0.0/16
• BConfigure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Remove the 35.100.0.0/16
• CConfigure Cloud NAT and create an exclusion rule for any SNAT address translation.
• DConfigure Cloud NAT with nonMasqueradeCIDRs, and enable SNAT with the same configuration

• A
  73% (19)
• B
  8% (2)
• C
  15% (4)
• D
  4% (1)

Explanation

In a VPC-native GKE Standard cluster, traffic to external destinations can go through Cloud NAT instead of using the nodes' external IP addresses. The ip-masq-agent ConfigMap controls whether specific IP ranges are masqueraded (i.e., source NAT applied) or not: Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap: Add the 35.100.0.0/16 range to the nonMasqueradeCIDRs list in the ConfigMap. This ensures that traffic destined for this range does not get source NATed by the GKE cluster itself but instead relies on Cloud NAT for external access. SNAT with Cloud NAT: Once the range 35.100.0.0/16 is excluded from GKE's masquerading, traffic to this range will flow through Cloud NAT for SNAT (source network address translation), enabling proper communication with the remote address. Avoid disrupting existing traffic: Including the 35.100.0.0/16 range ensures that only traffic to this specific destination uses Cloud NAT, leaving other traffic patterns unaffected.

No community discussion yet for this question.