<p>I have a GKE cluster set up with <a href="https://cloud.google.com/nat/docs/overview" rel="nofollow noreferrer">Cloud NAT</a>, so traffic from any node/container going outward would have the same external IP. (I needed this for whitelisting purposes while working with 3rd-party services).</p>

<p>Now, if I want to deploy a proxy server onto this cluster that does basic traffic forwarding, how do I expose the proxy server "endpoint"? Or more generically, how do I expose a service if I deploy it to this GKE cluster? </p>

<p>Normally, to expose a service endpoint running on a Kubernetes cluster, you have to use one of the <a href="https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types" rel="nofollow noreferrer">Service Types</a>, as Pods have internal IP addresses and are not addressable externally.</p>

<p>The possible service types:</p>

<ul>
<li><p><code>ClusterIP</code>: this also uses an internal IP address, and is therefore not addressable externally.</p></li>
<li><p><code>NodePort</code>: this type opens a port on every node in your Kubernetes cluster, and configures iptables to forward traffic arriving to this port into the Pods providing the actual service.</p></li>
<li><p><code>LoadBalancer</code>: this type opens a port on every node as with NodePort, and also allocates a <a href="https://cloud.google.com/load-balancing" rel="nofollow noreferrer">Google Cloud Load Balancer service</a>, and configures that service to access the port opened on the Kubernetes nodes (actually load balancing the incoming traffic between your operation Kubernetes nodes).</p></li>
<li><p><code>ExternalName</code>: this type configures the Kubernetes internal DNS server to point to the specified IP address (to provide a dynamic DNS entry inside the cluster to connect to external services).</p></li>
</ul>

<p>Out of those, <code>NodePort</code> and <code>LoadBalancer</code> are usable for your purposes. With a simple <code>NodePort</code> type Service, you would need publicly accessible node IP addresses, and the port allocated could be used to access your proxy service through any node of your cluster. As any one of your nodes may disappear at any time, this kind of service access is only good if your proxy clients know how to switch to another node IP address. Or you could use the <code>LoadBalancer</code> type Service, in that case you can use the IP address of the configured Google Cloud Load Balancer for your clients to connect to, and expect the load balancer to forward the traffic to any one of the running nodes of your cluster, which would then forward the traffic to one of the Pods providing this service.</p>

<p>For your proxy server to access the Internet as a client, you also need some kind of public IP address. Either you give the Kubernetes nodes public IP addresses (in that case, if you have more than a single node, you'd see multiple source IP addresses, as each node has its own IP address), or if you use private addresses for your Kubernetes nodes, you need a Source NAT functionality, like the one you already use: <a href="https://cloud.google.com/nat/docs/overview" rel="nofollow noreferrer">Cloud NAT</a></p>
