Firewall rules to allow GKE -> GCR traffic in separate projects

[Paco Ibañez]

I am running Kubernetes in GCP and I have the GKE cluster and the container registry in separate projects. For security, I would like to restrict any outgoing traffic from my GKE project at the VM level.  I have added an egress firewall rule to drop any traffic going out of my VPC network. As a consequence, GKE can't pull images from the registry anymore. Is there a way to write other firewall rule to allow traffic only to GCR?

Thanks!

[Karthick (Cloud Platform Support)]

Hello,

The IP addresses that are used by GCR are ephemeral. Can you be specific about what you mean by restricting outgoing traffic from GKE project at the VM level ? However, you can check this article for using cross project images in GKE. 

[Navi Aujla (Google Cloud Support)]

Hello Paco

You can add firewall rule to allow egress traffic for the GKE service account with appropriate permissions for the GCR, however there is no dedicated IP range for GCR which you can define in the firewall rule but can define 0.0.0.0 and mention the protocol (eg: tcp;udp).