<p>I currently have two clusters on GKE - one in <code>eu-west1-b</code> and another in <code>us-east1-b</code>. The pods deployed to the nodes in these clusters need to make location-based requests (for latency testing purposes).</p>

<p>I also need to connect to my postgres instance on RDS, which uses IP-based whitelisting for external connections. The nodes in my clusters have ephemeral IPs so I can't use them.</p>

<p>I have done a lot of research and gone through lots of SO answers and docs and tutorials and come to the solution that routing traffic through a NAT is pretty much the best/only way to do this right now on GKE.</p>

<p><a href="https://serverfault.com/questions/835425/kubernetes-external-connection-through-single-ip">https://serverfault.com/questions/835425/kubernetes-external-connection-through-single-ip</a></p>

<p>Similar to that question above, I don't want to route all of my traffic through the NAT. My reason is because I need my requests to come from the internet gateway associated with the current node so it is coming from a particular region.</p>

<p>The above question has some answers that almost get me there, but doesn't include any kube-specific configuaration. This is a great tutorial:</p>

<p><a href="https://docs.tenable.com/pvs/deployment/Content/GoogleCloudInstructionsNatGateway.htm" rel="nofollow noreferrer">https://docs.tenable.com/pvs/deployment/Content/GoogleCloudInstructionsNatGateway.htm</a></p>

<p>But again, is not based on kube.</p>

<p>My thinking is that I need to define a service for postgres in my kube cluster, and then tell that to route to the external service through the NAT. Not entirely sure where to start and would appreciate help.</p>

<p>A solution:</p>

<ol>
<li><p><a href="https://cloud.google.com/vpc/docs/add-remove-network-tags" rel="nofollow noreferrer">Tag</a> your instances in different zones/regions with different tags</p></li>
<li><p>Create static IP addresses for each zone/region</p></li>
<li><p>Create NAT exit nodes (GCE instances or instance groups) using the external address from above</p></li>
<li><p>Create a <a href="https://console.cloud.google.com/networking/routes/add" rel="nofollow noreferrer">route</a> trough each of the NAT exit nodes. Restrict each route with destination IP range for your RDS ingress IP/32 and network tags from Step 1 (so the instances use the correct gateway)</p></li>
</ol>
