<p>This is going to be more of a conceptual question.</p>
<p>I'm fairly new to Kubernetes and VPCs, and I'm currently studying in order to take part in designing a Kubernetes Cluster on GCP (Google Cloud Platform), and my role in that would be to address our security concerns.</p>
<p>Recently, I've been introduced to the concept of a &quot;Private Kubernetes Cluster&quot;, which runs on a VPC and only allows traffic of allowed agents and from inside the VPC, with the Control Plane being accessible by a Bastion, for instance.</p>
<p>The thing is, I'm not sure if doing this would mean completely air-gapping the Cluster, blocking any access from the internet outside of the VPC or if I'm still able to use this to serve public web services, such as websites and APIs, whilst using the VPC to secure the control plane.</p>
<p>Any insights on that? I would also appreciate some documentation and related articles.</p>
<p>I still haven't got to the implementation part, since I'm trying to make sure I know what I'm doing beforehand.</p>
<p>Edit: According to the documentation, I am able to expose some of my cluster's nodes by using Cloud NAT. But would this defeat the purpose of even having a private cluster?</p>

Pedro Souza
<blockquote>
<p>The thing is, I'm not sure if doing this would mean completely
air-gapping the Cluster, blocking any access from the internet outside
of the VPC or if I'm still able to use this to serve public web
services, such as websites and APIs, whilst using the VPC to secure
the control plane.</p>
</blockquote>
<p>Yes, you will be able to Host your web application and you can expose those with the LoadBalancer even if you <strong>Cluster</strong> is private.</p>
<p>With a public cluster, your Worker node will be having the <strong>External/Public</strong> <strong>IPs</strong> while in <strong>private</strong> <strong>cluster</strong> worker nodes won't be having <strong>public IP</strong>.</p>
<p>You can create the service type <strong>LoadBalancer</strong> or use the <strong>Ingress</strong> to expose the application.</p>
<p>If public API access is required you can use the <strong>NAT gateway</strong>. you can configure your <strong>firewall rules</strong> to <strong>allow egress traffic</strong> to the specific <strong>public API</strong> endpoint you want to access.</p>
<blockquote>
<p>Edit: According to the documentation, I am able to expose some of my
cluster's nodes by using Cloud NAT. But would this defeat the purpose
of even having a private cluster?</p>
</blockquote>
<p>Yes right, The main advantage of <strong>Private GKE</strong> cluster I am seeing it does not have any <strong>Public/External IP</strong> address so can't be accessed from outside only accessed from within the <strong>VPC</strong> network. It can help protect clusters from <strong>un-auth</strong> access and reduce the surface of attacks on apps also.</p>
<p>Refer the <a href="https://github.com/GoogleCloudPlatform/gke-private-cluster-demo#private-clusters" rel="nofollow noreferrer">Github</a> for terraform and other details.</p>
