<p>We are using Kubernetes on google cloud's Google Kubernetes Engine. Our system dynamically generates instances based on request and these instances call an external web service. The external service generates images and the bandwidth usage per instance is not small.</p>

<p>This external web service has an IP whitelisting configured.</p>

<p>Is there any way that I can funnel all the requests going from the selected pods (they are grouped within a node pool) to the external service with a single IP?</p>

aeroith
<p>The answer is <code>Yes</code>, there are actually several ways one can achieve this. I will answer a simple way to get this done. By tunnelling through a proxy server. </p>

<p>It could also be done assigning external ips to all your nodes and allowing them from webservice, but many engineers don't prefer doing it because no one wants to expose the nodes to the external world for a million security reasons.</p>

<p>Add a separate very small may be nano VM within the same cluster and install a <code>HAProxy</code> or <code>Nginx</code> or your favourite proxy. Or install the proxy on one of the instances you already have but make sure it has external ip attached to it, and it should be inside your cluster in order to reduce any latency issues. </p>

<p>Now bind the url in the proxy to accept connection to a particular port and route them to your instance that has your external webservice. This is an example of HAProxy code how it would look like.</p>

<pre><code>listen port_2020
  bind :2020
  mode tcp
  server external-web-service externalwebservice.mycompany.com:443 check
</code></pre>

<p>After the completion of this setup. Let's assume your k8s is running masters at <code>10.0.1.0/24</code> and nodes at <code>10.0.2.0/24</code>. And added this addition proxy service somewhere at <code>10.10.1.101/32</code> with an external ip of <code>52.*.*.*</code> with in the same VPC. Now all you have to do is open communication on <code>10.10.1.101</code> to accept communications to <code>port 2020</code> from <code>10.0.2.0/24</code>. </p>

<p>Now your pods have to keep polling <code>10.10.1.101:2020/api/health/check</code> instead of external webservice directly.</p>

<p>And now you can waitlist just the proxy vm ip <code>52.*.*.*</code> on your webservice vm without any issues.</p>

<p>This is just an example of how it could be done. But there are several approaches to get this done. There are many advanced ways of doing this using a sidecar as well.</p>

<p>Hope this is helpful.</p>
