<p>I am launching a service in a Kubernetes pod that I would like to be available to servers on the same subnet only.</p>
<p>I have created a service with a LoadBalancer opening the desired ports. I can connect to these ports through other pods on the cluster, but I cannot connect from virtual machines I have running on the same subnet.</p>
<p>So far my best solution has been to assign a loadBalancerIP and restrict it with loadBalancerSourceRanges, however this still feels too public.</p>
<p>The virtual machines I am attempting to connect to my service are ephemeral, and have a wide range of public IPs assigned, so my loadBalancerSourceRanges feels too broad.</p>
<p>My understanding was that I could connect to the internal LoadBalancer cluster-ip from servers that were on that same subnet, however this does not seem to be the case.</p>
<p>Is there another solution to limit this service to connections from internal IPs that I am missing?</p>
<p>This is all running on GKE.</p>
<p>Any help would be really appreciated.</p>

buffcat
<p>i think you are right here a little bit but not sure why you mentioned the <strong>cluster-ip</strong></p>
<blockquote>
<p>My understanding was that I could connect to the internal LoadBalancer
cluster-ip from servers that were on that same subnet, however this
does not seem to be the case.</p>
</blockquote>
<p>Now if you have <strong>deployment</strong> running on <strong>GKE</strong> and you have exposed it with <strong>service</strong> type <strong>LoadBalancer</strong> and have <strong>internal LB</strong> you will be able to access to <strong>internal LB</strong> across same <strong>VPC</strong>.</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: internal-svc
  annotations:
    networking.gke.io/load-balancer-type: &quot;Internal&quot;
spec:
  type: LoadBalancer
  externalTrafficPolicy: Cluster
  selector:
    app: internal-svcinternal-svc
  ports:
  - name: tcp-port
    protocol: TCP
    port: 8080
    targetPort: 8080
</code></pre>
<p>once your changes are applied check the status using</p>
<pre><code>kubectl get service internal-svc --output yaml
</code></pre>
<p>In YAML output check at last section for</p>
<pre><code>status:
  loadBalancer:
    ingress:
    - ip: 10.127.40.241
</code></pre>
<p>that's your actual <strong>IP</strong> you can use to connect with service from other <strong>VMs</strong> in subnet.</p>
<p><a href="https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing#create" rel="nofollow noreferrer">Doc ref</a></p>
