<p>I have created a new cluster in GKE with version 1.10.5-gke.0.
I see that my applications cannot reach IPs in the same network, basically instances running on compute.</p>

<p>I have ssh'd to one of the Kubernetes nodes, and by using the toolbox included i can ping those IP addresses, but I can't if I try from a container running on this cluster.</p>

<p>I saw that since 1.10 google disables access scopes for compute &amp; storage, and even if I enable those scopes I still get the same.</p>

<p>I find it a bit puzzling, as this used to work for all other clusters in the past without any extra config needed</p>

<p>Am I missing something here?</p>

<p>An easy way of doing fixing this is using the Google Cloud Console. </p>

<p>Go to </p>

<blockquote>
  <p>Navigation Menu -> VPC network -> Firewall rules</p>
</blockquote>

<p>. </p>

<p>Normally when a cluster is created, a number of rules are created automatically with certain prefixes and suffixes. Look in the table of rules with a <strong>gke-</strong> prefix and an <strong>-all</strong> suffix e.g. gke-[my_cluster_name]-all. You'll notice for this rule, it has the source ranges for your pods within the cluster and quite a few protocols (tcp, udp, imp, esp, etc.) allowed.</p>

<p><strong>Select this rule</strong> and go to <strong>Edit</strong>. Under <strong>Targets</strong>, select the drop down and change to <strong>All instances in the network</strong>. </p>

<p>Alternatively, you can choose specified <strong>Specified target tags</strong> or <strong>Specified service account</strong>, inputing the correct values below, like your correct developer service account for the compute engine you're trying to reach. </p>

<p>You can also look here if you're Kubernetes is version 1.9.x and later for another alternative way. <a href="https://cloud.google.com/kubernetes-engine/docs/troubleshooting#autofirewall" rel="noreferrer">Troubleshooting</a></p>

<p>Hope all this helps.      </p>
