<p>I have two cluster in GCP.</p>
<ol>
<li>GKE cluster which has only postgres installed using Kubernetes.</li>
<li>A dataproc cluster.</li>
</ol>
<p>Now if i make the service of postgres as Internally load balanced to provide security i can access it using my VPN configurations .</p>
<p>But the problem got while accessing the Postgres from the dataproc cluster. The communication wasnt successful. Hence i had to made the postgres public load balanced.</p>
<p>I want suggestions here how we can achieve security here.? making database less accessible however it should be still accessible by Dataproc cluster.</p>

Nishchal Dinesh
<p>If you are using the <strong>LoadBancer</strong> to expose the service directly and not using the Ingress you can use the <strong>IP whitelisting</strong> option to Whitelist your <strong>Data Cluster</strong> IPs.</p>
<p>Example</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: postgres
spec:
ports:
    - port: 8765
      targetPort: 9376
  selector:
    app: example
  type: LoadBalancer
  loadBalancerIP: 79.78.77.76
  loadBalancerSourceRanges:
  - 130.211.204.1/32
  - 130.211.204.2/32  
</code></pre>
<p>You can add the <strong>Data cluster</strong> <strong>IPs</strong> (or the whole VPC subnet IP range in which the cluster is) in <strong>LoadBalancer</strong> service and only requests coming from cluster will be access the database.</p>
<p>Refer to the <a href="https://aws.amazon.com/premiumsupport/knowledge-center/eks-cidr-ip-address-loadbalancer/" rel="nofollow noreferrer">link</a> for more information</p>
<p><strong>Ingress</strong></p>
<p>If you are using the ingress to expose the database</p>
<p>You can use the annotation :</p>
<pre><code>ingress.kubernetes.io/whitelist-source-range
</code></pre>
<p>to whitelist the IPs</p>
