<p>Is it possible to run a private GKE cluster(private endpoint and nodes) behind an HTTP proxy?</p>

<p>GKE nodes need an internet connection to pull docker images from public repositories. The problem is, we don't want to login each GKE nodes and configure <code>http_proxy</code> environment variables and repeat this after every cluster upgrades.</p>

<p>Is it possible to automate setting <code>http_proxy</code> environment variable for each node or is there a better way to configure <code>http_proxy</code> on a private GKE cluster?</p>

<p>You can use <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/daemonset" rel="nofollow noreferrer">DaemonSet</a> for deploying ongoing background tasks (automate setting http_proxy) that you need to run on all or certain nodes. Example:</p>

<pre><code>kind: DaemonSet
apiVersion: extensions/v1beta1
metadata:
  name: startup-script
  labels:
    app: startup-script
spec:
  template:
    metadata:
      labels:
        app: startup-script
    spec:
      hostPID: true
      containers:
        - name: startup-script
          image: gcr.io/basic-app-with-example/startup-script:v1
          imagePullPolicy: Always
          securityContext:
            privileged: true
          env:
          - name: STARTUP_SCRIPT
            value: |
              #! /bin/bash
              list of the command that you need to execute in node
              export http_proxy='http://&lt;host&gt;:&lt;port&gt;'
</code></pre>

<p>And you could use Cloud NAT in GCP to allow your private GKE cluster to reach public repositories.</p>
