title: How do I connect Cloud Composer Airflow DAG to a VPN
body: <p>How do I allow a Cloud Composer Airflow DAG to connect to a REST API via VPN gateway? The cluster is connected to the according VPC.</p>
  <p>The kube-proxy is able to reach the API, yet the containers can not.</p>
  <p>I have SSH'd into the kube-proxy and containers and tried a traceroute. The containers' traceroute ends with the kube-proxy. The kube-proxy has 4 hops before reaching destination.</p>
  <p>I have dumped the iptables from the kube-proxy, they do not specify anything in regards to NATing the VPCs subnet with the containers.</p>
  <p>The VPC subnet also does not show up in the containers, which is by design.</p>
  <p>Some reading material:
  <a href="https://www.stackrox.com/post/2020/01/kubernetes-networking-demystified/" rel="nofollow noreferrer">https://www.stackrox.com/post/2020/01/kubernetes-networking-demystified/</a></p>
  <p>EDIT1: More info:
  Let's assume the VPN connects the VPC to the remote 10.200.0.0 network.<br />
  The VPC has multiple subnets. The primary range is e.g. 10.10.0.0/20. For each Kubernetes cluster we have two more subnet, one for each pod (10.16.0.0/14) and another for services (10.20.0.0/20). The gateway is 10.10.0.1.<br />
  Each pod again has it's own range, where pod_1 is 10.16.0.0/14, pod_2 is 10.16.1.0/14, pod_3 10.16.3.0/14 and so on.<br />
  One of the kube-proxies has multiple network adapters. It resides in the 10.10.0.0 network with eth0 and has a cbr0 bridge to 10.16.0.0. Through said kube-proxy via the bridge the workers for Airflow are connecting to the network. One worker e.g. 10.16.0.1 has only one network adapter.</p>
  <p>The kube-proxy can reach the 10.200.0.0 network. The Airflow workers can not.</p>
  <p>How do we get the worker to access the 10.200.0.0 network? Do we need to change the iptables of the kube-proxy?</p>