<p>I have a GKE cluster set up with <a href="https://cloud.google.com/nat/docs/overview" rel="nofollow noreferrer">Cloud NAT</a>, so traffic from any node/container going outward would have the same external IP. (I needed this for whitelisting purposes while working with 3rd-party services).</p>

<p>Now, if I want to deploy a proxy server onto this cluster that does basic traffic forwarding, how do I expose the proxy server "endpoint"? Or more generically, how do I expose a service if I deploy it to this GKE cluster? </p>

<p><strong>Proxy server running behind NAT ?</strong></p>

<p>Bad idea, unless it is only for your <strong>kubernetes cluster</strong> workload, but you didn't specify anywhere that it should be reachable only by other <code>Pods</code> running in the same cluster.</p>

<p>As you can read <a href="https://cloud.google.com/nat/docs/overview" rel="nofollow noreferrer">here</a>:</p>

<blockquote>
  <p>Cloud NAT does not implement unsolicited inbound connections from the
  internet. DNAT is only performed for packets that arrive as responses
  to outbound packets.</p>
</blockquote>

<p>So it is not meant to be reachable from outside.</p>

<p>If you want to expose any application within your cluster, making it available for other <code>Pods</code>, use simple <code>ClusterIP</code> <a href="https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service" rel="nofollow noreferrer">Service</a> which is the default type and it will be created as such even if you don't specify its type at all.</p>
