<p>AWS RDS Security Groups are great for restricting to specific IP addresses.</p>

<p>My Google Cloud deployment is an Ingress at a static IP. The Ingress points to one or several nodes. Those nodes have non-static IP addresses.</p>

<p><strong>How do I restrict AWS RDS to only those nodes?</strong> </p>

<p>(Restricting to the Ingress IP would not, and does not, work.) </p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: xxxxx
  annotations:
    kubernetes.io/ingress.global-static-ip-name: xxxxx-ip
  labels:
    app: xxxxx
spec:
  rules:
    - http:
        paths:
          - path: /*
            backend:
              serviceName: xxxxx
              servicePort: 3000
</code></pre>

David Bernat
<p>Google Kubernetes nodes are ephemeral and if enabled autoscale. This means that you cannot rely upon the IP address of a node or collection of nodes. At this time, Google does not support assigning a static pool of addresses to a GKE cluster.</p>

<p>There is an opensource project KubeIP which can help you solve this. I have not used this project on GKE, do your own research on viability for your project.</p>

<p><a href="https://github.com/doitintl/kubeip" rel="nofollow noreferrer">KubeIP</a></p>

<p>Don't forget that you will be charged for allocated static IP addresses that are not assigned to a Google service (Load Balancer, Compute Engine, etc).</p>
