<h2>Background</h2>

<p>Just deployed my new Kubernetes cluster to Google Cloud. It's a private cluster - available only from the internal network. I connecting this cluster from <code>bastion</code> machine. With my <code>bastion</code> host, I can manage my cluster. </p>

<p>My cluster configuration:</p>

<p><a href="https://i.stack.imgur.com/DqRw0.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DqRw0.png" alt="enter image description here"></a></p>

<h2>The Problem</h2>

<p>It's seems like my pods doent have network to go out of the pod. for example: </p>

<pre><code>$ curl google.com 
</code></pre>

<p>Return error - unable to connect. So I logged the pod with SSH and tried to figure out what is the problem. </p>

<p>Two options that I can think of:</p>

<ol>
<li><p>Firewall blocks all the egress traffic by default? I tried to allow it with new firewall rule that allow egress.
<a href="https://i.stack.imgur.com/A2Y8o.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/A2Y8o.png" alt="enter image description here"></a>
It's didn't solved the problem. (where <code>10.56.0.0/14</code> is my pods range)</p></li>
<li><p>My network dont have "default gateway" that allow internet access. I checked in "routers" area and it seems like it there:
<a href="https://i.stack.imgur.com/2N0YV.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/2N0YV.png" alt="enter image description here"></a></p></li>
</ol>

<h2>Question</h2>

<p>How to solved the issue and let my pods access to the internet freely?</p>

No1Lives4Ever
<p>Found the missing part. </p>

<blockquote>
  <p>In the Kubernetes Engine Private Cluster model, your nodes have access
  to the rest of your VPC private deployments, including private access
  to Google managed services such as gcr.io, Google Cloud Storage and
  Google BigQuery. Access to the internet isn’t possible unless you set
  up additional mechanisms such as a NAT gateway.</p>
</blockquote>

<p><a href="https://cloud.google.com/blog/products/gcp/kubernetes-engine-private-clusters-now" rel="nofollow noreferrer">source</a>.</p>

<p>Adding NAT solved the issue!</p>
