<p>I use external docker registry in my GKE cluster to pull containers. This docker registry has security access list (which is basically list of client's public IP addresses). However, GKE cluster creates nodes with ephemeral IP addresses and makes it inconvenient to add each new IP address into access list.</p>

<p><strong>How can I create proxy or port forwarding in google cloud to forward all requests via one external IP to access my external registry ?</strong></p>

<p><img src="https://i.imgur.com/U3lLOV9.png" alt="graph"></p>

<p>You should use <a href="https://cloud.google.com/nat/docs/overview" rel="nofollow noreferrer">Cloud NAT</a>. It will act at the proxy in your diagram and you can use the addresses of the NAT in the ACLs of the container registry. Also check out <a href="https://medium.com/google-cloud/using-cloud-nat-with-gke-cluster-c82364546d9e" rel="nofollow noreferrer">this tutorial</a> on setting up Cloud NAT with GKE. </p>
