Set up firewall rules for cluster in GCP deployer

[kawych]

In clusters created with GCP deployer, pods can't connect to ports exposed by Kubelet on other nodes. For my cluster "test1" I worked it around adding a firewall rule:

Targets: test1-worker
Source IP ranges: 192.168.1.0/24, 192.168.0.0/24
Protocols: tcp
Action: ALLOW

192.168.1.0/24, 192.168.0.0/24 are IP ranges of pods in my cluster.

cc @karan @krousey

[spew]

Taking a look at fixing this one.

[spew]

I have reproduced this issue, there is active work going on in this area by @mkjelland

[spew]

Issue assigned to @mkjelland

[kawych]

@spew @mkjelland

This is not fixed yet. The firewall rule added in #352 enables communication between cluster nodes, but does not allow connections from pods running on a cluster to ports exposed from other nodes.

[spew]

/reopen

[k8s-ci-robot]

@spew: you can't re-open an issue/PR unless you authored it or you are assigned to it.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[spew]

@mkjelland can you take a look at this one?

[mkjelland]

/reopen
I'll take another look, thanks!

[roberthbailey]

@kawych - is this relevant to the google provider in clusterctl? The gcp deployer code is going away prior to the alpha release of the cluster api.

[roberthbailey]

Manually moved to kubernetes-sigs/cluster-api-provider-gcp#70.