<p>I was using NodePort to host a webapp on Google Container Engine (GKE). It allows you to directly point your domains to the node IP address, instead of an expensive Google load balancer. Unfortunately, instances are created with HTTP ports blocked by default, and an update locked down manually changing the nodes, as they are now created using and Instance Group/and an Immutable Instance Template.</p>

<p><strong>I need to open port 443 on my nodes, how do I do that with Kubernetes or GCE? Preferably in an update resistant way.</strong></p>

<p><a href="https://i.stack.imgur.com/cBa5b.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/cBa5b.png" alt="enter image description here"></a></p>

<p>Related github question: <a href="https://github.com/nginxinc/kubernetes-ingress/issues/502" rel="nofollow noreferrer">https://github.com/nginxinc/kubernetes-ingress/issues/502</a></p>

<p>Update: A deamonset with a nodeport can handle the port opening for you. nginx/k8s-ingress has a nodeport on 443 which gets exposed by a custom firewall rule. the GCE UI will not show「Allow HTTPS traffic」as checked, because its not using the default rule.</p>
<hr />
<p>You can do everything you do on the GUI Google Cloud Console using the Cloud SDK, most easily through the Google Cloud Shell. Here is the command for adding a network tag to a running instance. This works, even though the GUI disabled the ability to do so</p>
<pre><code>gcloud compute instances add-tags gke-clusty-pool-0-7696af58-52nf --zone=us-central1-b --tags https-server,http-server
</code></pre>
<p>This also works on the beta, meaning it should continue to work for a bit.
See <a href="https://cloud.google.com/sdk/docs/scripting-gcloud" rel="nofollow noreferrer">https://cloud.google.com/sdk/docs/scripting-gcloud</a> for examples on how to automate this. Perhaps consider running on a webhook when downtime is detected. Obviously none of this is ideal.</p>
<p>Alternatively, you can change the templates themselves. With this method you can also add a startup to new nodes, which allows you do do things like fire a webhook with the new IP Address for a round robin low downtime dynamic dns.</p>
<p>Source (he had the opposite problem, his problem is our solution): <a href="https://stackoverflow.com/a/51866195/370238">https://stackoverflow.com/a/51866195/370238</a></p>
