<p>We want to access some services on Google Kubernetes Engine from a Google App Engine standard via http(s). We don't want to expose the services to external networks because of security.</p>

<ul>
<li><p>app engine flexible can use private network with an <a href="https://cloud.google.com/kubernetes-engine/docs/internal-load-balancing?hl=ja" rel="nofollow noreferrer">internal loadbalancer</a> or <a href="https://cloud.google.com/compute/docs/vpc/?hl=ja" rel="nofollow noreferrer">vpc</a>(<a href="https://stackoverflow.com/questions/51198865/connect-to-kubernetes-engine-from-app-engine">post</a>). How about app engine standard?</p></li>
<li><p>2 years ago, we could not do it. (<a href="https://stackoverflow.com/questions/34747449/connect-from-appengine-to-a-kubernetes-service-from-google-containers">post</a>)</p></li>
<li><p>We can set rules about IP addresses, but an IP address for an app engine standard is not static.</p></li>
</ul>

<p>What is the best solution? </p>

<p>Thanks for your help.</p>

Kaz_JP
<blockquote>
  <p>app engine flexible can use private network with an internal loadbalancer or vpc(post). How about app engine standard?</p>
</blockquote>

<p>Not really as per <a href="https://cloud.google.com/vpc/docs/vpc" rel="nofollow noreferrer">this</a>:</p>

<p>"A VPC network, sometimes just called a “network,” is a virtual version of a physical network, like a data center network. It provides connectivity for your Compute Engine virtual machine (VM) instances, Kubernetes Engine clusters, App Engine Flex instances, and other resources in your project."</p>

<blockquote>
  <p>We can set rules about IP addresses, but an IP address for an app engine standard is not static.</p>
</blockquote>

<p>Yes. They are always changing. The recommendation here is to their <a href="https://cloud.google.com/appengine/kb/" rel="nofollow noreferrer">Static IP range</a> combined with:</p>

<blockquote>
  <p>Instead, we suggest that you take a <a href="https://en.wikipedia.org/wiki/Defense_in_depth_(computing)" rel="nofollow noreferrer">defense in depth</a> approach using <a href="https://en.wikipedia.org/wiki/OAuth" rel="nofollow noreferrer">OAuth</a> and <a href="https://en.wikipedia.org/wiki/Public_key_certificate" rel="nofollow noreferrer">Certs</a>.</p>
</blockquote>

<p>You could also look at things like <a href="https://cloud.google.com/armor/" rel="nofollow noreferrer">Cloud Armor</a> (in alpha as of this writing), or a <a href="https://console.cloud.google.com/marketplace/details/brocade-public-1063/safpx-csub-1000" rel="nofollow noreferrer">Virtual WAF</a>. Longer term it would make more sense to move your workloads from Google App engine into GKE.</p>
