<p>Unfortunately, we have to interface with a third-party service which instead of implementing authentication, relies on the request IP to determine if a client is authorized or not.</p>

<p>This is problematic because nodes are started and destroyed by Kubernetes and each time the external IP changes. Is there a way to make sure the external IP is chosen among a fixed set of IPs? That way we could communicate those IPs to the third party and they would be authorized to perform requests. I only found a way to fix the service IP, but that does not change at all the single nodes' IPs.</p>

<p>To be clear, we are using Google's Kubernetes Engine, so a custom solution for that environment would work too.</p>

<p>Yes, it's possible by using <a href="https://github.com/doitintl/kubeip" rel="noreferrer">KubeIP</a>.</p>

<p>You can create a pool of shareable IP addresses, and use KubeIP to automatically attach IP address from the pool to the Kubernetes node.</p>

<p>IP addresses can be created by:</p>

<ol>
<li>opening Google Cloud Dashboard</li>
<li>going VPC Network -> External IP addresses</li>
<li>clicking on "Reserve Static Address" and following the wizard (on the Network Service Tier, I think it needs to be a "Premium", for this to work).</li>
</ol>
