I have two clusters. Cluster A (on google container engine) is a public facing cluster and it needs to connect to a private Cluster B (a click-to-deploy cluster on GCE) to access a service. I would like to have Cluster A connect to Cluster B through a load balancer, and that can work even though it seems as though all GCE load balancers require a public IP address https://groups.google.com/d/topic/gce-discussion/Dv6289i4_rg/discussion (I'd prefer if it were all private).
The public IP address isn't so bad by itself if you could just set a simple firewall rule and use the standard Google Load Balancer. Unfortunately source-tags don't seem to cross the WAN threshold (or are just not passed by the load balancer). This is the rule that I'd want to use:
gcloud compute firewall-rules create servicename-lb-from-gke-cluster --allow tcp:1234 --source-tags k8s-gke-cluster-node --target-tags servicename #DOES NOT WORK
After entering the above command, Cluster A cannot communicate to Cluster B (via load balancer) through tcp port 1234.
This does work, but it is painful because it requires supervision to automate setting the public IP addresses of the source cluster:
gcloud compute firewall-rules create servicename-lb-from-gke-cluster --allow tcp:1234 --source-ranges 100.2.3.4/32 100.3.5.9/32 100.9.1.2/32 --target-tags servicename #Does work, but is painful
As suggested in the google groups thread, HA proxy is another suggestion.
Another idea is to open up the firewall to the entire WAN and add secure authentication between cluster A and B. Maybe this is a good idea to do for security reasons anyway? The difficulty may range from easy to hard depending on what cluster A and B are running though - it might be nice to have a more general solution.
Does anyone have a better idea? Does anyone else have the same problem?