<p>I've got a database running in a private network (say IP 1.2.3.4).</p>
<p>In my own computer, I can do these steps in order to access the database:</p>
<ul>
<li>Start a Docker container using something like <code>docker run --privileged --sysctl net.ipv4.ip_forward=1 ...</code></li>
<li>Get the container IP</li>
<li>Add a routing rule, such as <code>ip route add 1.2.3.4/32 via $container_ip</code></li>
</ul>
<p>And then I'm able to connect to the database as usual.</p>
<p>I wonder if there's a way to route traffic through a specific pod in Kubernetes for certain IPs in order to achieve the same results. We use GKE, by the way, I don't know if this helps in any way.</p>
<p>PS: I'm aware of the sidecar pattern, but I don't think this would be ideal for our use case, as our jobs are short-lived tasks, and we are not able to run multiple &quot;gateway&quot; containers at the same time.</p>

Gabriel Milan
<p><code>I wonder if there's a way to route traffic through a specific pod in Kubernetes for certain IPs in order to achieve the same results. We use GKE, by the way, I don't know if this helps in any way.</code></p>
<p>You can start a GKE in a fully private network like <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters" rel="nofollow noreferrer">this</a>, then you run application that needs to be fully private in this cluster. Access to this cluster is only possible when explicitly granted; just like those commands you used in your question, but of course now you will use the cloud platform (eg. service control, bastion etc etc), there is no need to &quot;route traffic through a specific pod in Kubernetes for certain IPs&quot;. But if you have to run everything in a cluster, then likely a fully private cluster will not work for you, in this case you can use <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/network-policy" rel="nofollow noreferrer">network policy</a> to control access to your database pod.</p>
