<p>First for my question, I need to talk a bit about my enviroments:</p>

<ol>
<li><p>Google Basic Setup: <em>1x</em> f1-micro instance with 3 nodes</p></li>
<li><p>Kubernetes Setup: nginx-ingress-controller, cert-manager, <em>1</em>-backend service with deployment, <em>1</em>-frontend service with deployment.</p></li>
<li><p>Mongo Atlas Setup: <em>3</em>-replicaSet</p></li>
</ol>

<p>Setup should not be a prolbem, but It might give some scenario feelings.</p>

<p>OK, Let comes to the issue, my Nodejs backend use the following url to connect to <strong>MonglAtlas database</strong>:</p>

<pre><code>MONGODB_URI=mongodb+srv://username:pwd@mongotoken-66gqa.gcp.mongodb.net/test?retryWrites=true
</code></pre>

<p>IP Whitelist is my static public IP that use nginx-ingress to route. Let me define <code>my.domain</code> to my frontend webpage, and <code>my.domain/api/</code> to backend api. </p>

<p>Everything is fine when IP Whitelist is <strong>ALLOW ACCESS FROM ANYWHERE</strong>, and backend could connect to MongoAtlas DB for no doubt.</p>

<p>But when I delete that option, and add the IP that matched with <code>my.domain</code> (double check, I ping <code>my.domain</code> is absolutely same  IP), and then backend could not find the database with following error:</p>

<pre><code>MongoNetworkError: connection 4 to closed https....
</code></pre>

<p>If there is something missing infos, please let me know. Any advice is appreciated!</p>

<p>Another suspected is that I got <em>1</em> static IP and <em>3</em> ephemeral IP in VPC network. I guess It means 3 node with loadbalancer IP. If the backend use ephemeral IP to connect to MongoAtlas backend, I must check the pod that in which nodes and make that node static, but this make no sense for Kubernetes. I hope there is another solution :(</p>

<p>The solution I used is <a href="https://cloud.google.com/solutions/using-a-nat-gateway-with-kubernetes-engine" rel="nofollow noreferrer">NAT</a>.
The concept is to establish <em>1-</em> Google Compute Engine Instance as NAT Gateway, and mapping all the egress to a static ip. Oh, the most important is all the steps above do not need to manual config, just follow the documentation, and everything should be work as expected.</p>

<p>If there is a <strong>STATIC_ADDRESS QUOTA</strong> problem, you could change your ZONE and REGION to any QUOTA-remained area. For my case, us-central as NAT and us-west as Original Service. </p>
