<p>So i created a cluster containing 4 machines using this command</p>

<pre><code>gcloud container clusters create "[cluster-name]" \
  --machine-type "n1-standard-1" \
  --image-type "COS" \
  --disk-size "100" \
  --num-nodes "4"
</code></pre>

<p>and i can see that it's creating 4 VM instances inside my <a href="https://console.cloud.google.com/compute/instances" rel="nofollow noreferrer">compute engine</a>. I then setup deployments pointing to one or more entry(ies) in my container registry and services with a single service exposing a public ip</p>

<p>all of this is working well, but it bothers me that all 4 VM instances it has created is having public ip(s), please do correct me if i am wrong, but to my understanding here's what happen behind the scene</p>

<ol>
<li>A container is created</li>
<li>VM instances is created based on #1</li>
<li>An instance group is created, with VM instances on #2 as members</li>
<li>(Since i have one of the service exposing a public ip) a network load balancer is created pointing to the instance group on #3 or the VM instances on #2</li>
</ol>

<p>Looking at this, i don't think i need a public ip on each of the VM instances created for the cluster.</p>

<p>I have been reading the <a href="https://cloud.google.com/container-engine/docs/clusters/operations" rel="nofollow noreferrer">documentation</a>(<a href="https://cloud.google.com/sdk/gcloud/reference/container/clusters/create" rel="nofollow noreferrer">s</a>), although i think i might have missed something, but i can't seem to find the configuration arguments that will allow me to achieve this </p>

<p>Currently all GKE VMs get a public IP address, but they have firewall rules set up to block unauthorized network connections. Your Service or Ingress resources are still accessed through Load Balancer’s public IP address.</p>

<p>As of writing there's no way to prevent cluster nodes from getting public IP addresses.</p>
