<p>Its not clear to me how to do this.</p>

<p>I create a service for my cluster like this:</p>

<pre><code>kubectl expose deployment my-deployment --type=LoadBalancer --port 8888 --target-port 8888
</code></pre>

<p>And now my service is accessible from the internet on port 8888. But I dont want that, I only want to make my service accessible from a list of specific public IPs. How do I apply a gcp firewall rule to a specific service? Not clear how this works and why by default the service is accessible publicly from the internet.</p>

<p><code>loadBalancerSourceRanges</code> seems to work and also updates the dynamically created GCE firewall rules for the service</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: na-server-service
spec:
  type: LoadBalancer
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
  loadBalancerSourceRanges:
  - 50.1.1.1/32
</code></pre>
