google-cloud-platform - 为公共(public) GKE 集群设置 Cloud NAT

Question

我想设置一个 NAT 网关，使用 Cloud NAT ，以便公共(public) GKE 集群中的 VM/Pod 使用静态 IP 地址。

我面临的问题是 NAT 网关似乎只在虚拟机没有其他选项时使用，即:

GCP forwards traffic using Cloud NAT only when there are no other matching routes or paths for the traffic.

但在公共(public) GKE 集群的情况下，VM 具有临时的外部 IP，因此它们不使用网关。

根据文档:

If you configure an external IP on a VM's interface [...] NAT will not be performed on such packets. However, alias IP ranges assigned to the interface can still use NAT because they cannot use the external IP to reach the Internet.

和

With this configuration, you can connect directly to a GKE VM via SSH, and yet have the GKE pods/containers use Cloud NAT to reach the Internet.

这就是我想要的，但我看不到在这里设置什么。
alias IP ranges assigned to the interface can still use NAT 暗示了什么以及如何设置？

Answer 1

"Unfortunately, this is not currently the case. While Cloud NAT is still in Beta, certain settings are not fully in place and thus the pods are still using SNAT even with IP aliasing. Because of the SNAT to the node's IP, the pods will not use Cloud NAT."

事实上，正如 Patrick W 上面所说的，它目前没有按记录工作。我也尝试过，并在 Kubernetes Engine channel 中与 GCP Slack 小组的人们交谈。他们还在测试中确认它仅适用于 GKE 私有(private)集群。我们还没有开始使用私有(private)集群。我找不到关于这个简单问题的可靠文档:如果我创建了一个私有(private)集群，我仍然可以在该集群中拥有公共(public) K8S 服务(又名负载均衡器)吗？所有关于私有(private) GKE 集群的文档都表明您不希望任何外部流量进入，但我们正在 GKE 集群上运行面向 Internet 的生产服务。
我向 GCP 支持提交了一张关于 Cloud NAT 问题的票，他们是这样说的:

"I have been reviewing your configuration and the reason that Cloud NAT is not working is because your cluster is not private.To use Cloud NAT with GKE you have to create a private cluster. In the non-private cluster the public IP addresses of the cluster are used for communication between the master and the nodes. That’s why GKE is not taking into consideration the Cloud NAT configuration you have.Creating a private cluster will allow you to combine Cloud NAT and GKE.

I understand this is not very clear from our documentation and I have reported this to be clarified and explained exactly how it is supposed to work."

我回复要求他们请按照文档进行操作，而不是更改他们的文档。我正在等待他们的更新...