This page describes the firewall rules that Google Kubernetes Engine (GKE) creates automatically in Google Cloud.
In addition to the GKE-specific rules listed on this page, by default, Google Cloud projects include Pre-populated firewall rules . GKE clusters are typically deployed within a VPC network. These rules grant essential network access for GKE clusters. These rules are sufficient for basic cluster operation, but you may need to create additional rules depending on your specific needs.
Firewall rules
GKE creates firewall rules automatically when creating the following resources:
- GKE clusters
- GKE Services
- GKE Gateways and HTTPRoutes
- GKE Ingresses
Unless otherwise specified, the priority for all automatically created firewall rules is 1000, which is the default value for firewall rules . If you would like more control over firewall behavior, you can create firewall rules with a higher priority . Firewall rules with a higher priority are applied before automatically created firewall rules.
GKE cluster firewall rules
GKE creates the following ingress firewall rules when creating a cluster:
gke-[cluster-name]-[cluster-hash]-master
gke-[cluster-name]-[cluster-hash]-vms
Used for intra-cluster communication required by the Kubernetes networking model . Allows software running on nodes to send packets, with sources matching node IP addresses, to destination Pod IP and node IP addresses in the cluster. For example, traffic allowed by this rule includes:
- Packets sent from system daemons, such as kubelet, to node and Pod IP address destinations of the cluster.
- Packets sent from software running in Pods with
hostNetwork:true
to node and Pod IP address destinations of the cluster.
- For auto mode VPC networks
,
GKE uses the
10.128.0.0/9
CIDR because that range includes all current and future subnet primary IPv4 address ranges for the automatically created subnetworks. - For custom mode VPC networks , GKE uses the primary IPv4 address range of the cluster's subnet.
gke-[cluster-name]-[cluster-hash]-all
Pod CIDR
For clusters with discontiguous multi-Pod CIDR enabled, all Pod CIDR blocks used by the cluster.
gke-[cluster-hash]-ipv6-all
Same IP address range allocated in subnetIpv6CidrBlock
.
gke-[cluster-name]-[cluster-hash]-inkubelet
Internal Pod CIDRs and Node CIDRs.
gke-[cluster-name]-[cluster-hash]-exkubelet
0.0.0.0/0
GKE Service firewall rules
GKE creates the following ingress firewall rules when creating a Service :
k8s-fw-[loadbalancer-hash]
spec.loadBalancerSourceRanges
. Defaults to 0.0.0.0/0
if spec.loadBalancerSourceRanges
is omitted. For more details, see Firewall rules and source IP address allowlist .
k8s-[cluster-id]-node-http-hc
externalTrafficPolicy
is set to Cluster
.-
130.211.0.0/22
-
35.191.0.0/16
-
209.85.152.0/22
-
209.85.204.0/22
k8s-[loadbalancer-hash]-http-hc
externalTrafficPolicy
is set to Local
.-
130.211.0.0/22
-
35.191.0.0/16
-
209.85.152.0/22
-
209.85.204.0/22
spec.healthCheckNodePort
. Defaults to TCP port number 10256
if spec.healthCheckNodePort
is omitted. For more details, see Health check port .
k8s-[cluster-id]-node-hc
externalTrafficPolicy
is set to Cluster
.-
130.211.0.0/22
-
35.191.0.0/16
-
209.85.152.0/22
-
209.85.204.0/22
[loadbalancer-hash]-hc
externalTrafficPolicy
is set to Local
.-
130.211.0.0/22
-
35.191.0.0/16
-
209.85.152.0/22
-
209.85.204.0/22
spec.healthCheckNodePort
. Defaults to TCP port number 10256
if spec.healthCheckNodePort
is omitted. For more details, see Health check port .
k8s2-[cluster-id]-[namespace]-[service-name]-[suffixhash]
spec.loadBalancerSourceRanges
. Defaults to 0.0.0.0/0
if spec.loadBalancerSourceRanges
is omitted. For more details, see Firewall rules and source IP address allowlist .
k8s2-[cluster-id]-[namespace]-[service-name]-[suffixhash]-fw
externalTrafficPolicy
is set to Local
and any of the following are enabled: -
130.211.0.0/22
-
35.191.0.0/16
-
209.85.152.0/22
-
209.85.204.0/22
spec.healthCheckNodePort
. Defaults to TCP port number 10256
if spec.healthCheckNodePort
is omitted. For more details, see Health check port .
k8s2-[cluster-id]-l4-shared-hc-fw
externalTrafficPolicy
is set to Cluster
and any of the following are enabled: -
130.211.0.0/22
-
35.191.0.0/16
-
209.85.152.0/22
-
209.85.204.0/22
gke-[cluster-name]-[cluster-hash]-mcsd
GKE Gateway firewall rules
GKE creates the following Gateway firewall rules when creating a Gateway and HTTPRoute resources:
-
gkegw1-l7-[network]-[region/global]
-
gkemcg1-l7-[network]-[region/global]
Permits health checks of a network endpoint group (NEG) .
The Gateway controller creates this rule when the first Gateway resource is created. The Gateway controller can update this rule if more Gateway resources are created.
-
130.211.0.0/22
-
35.191.0.0/16
- User defined proxy-only subnet ranges (for internal Application Load Balancers)
GKE Ingress firewall rules
GKE creates the following Ingress firewall rules when creating an Ingress resource:
k8s-fw-l7-[random-hash]
Permits health checks
of a NodePort
Service or network endpoint group (NEG)
.
The Ingress controller creates this rule when the first Ingress resource is created. The Ingress controller can update this rule if more Ingress resources are created.
-
130.211.0.0/22
-
35.191.0.0/16
-
209.85.152.0/22
-
209.85.204.0/22
- User defined proxy-only subnet ranges (for internal Application Load Balancers)
-
130.211.0.0/22
-
35.191.0.0/16
- User-defined proxy-only subnet ranges (for internal Application Load Balancers)
Shared VPC
When a cluster that is located in a Shared VPC uses a Shared VPC network, the Ingress controller cannot use the GKE service account in the service project to create and update ingress allow firewall rules in the host project. You can grant the GKE service account in a service project permissions to create and manage the firewall resources. For more information, see Shared VPC .
Required firewall rule for expanded subnet
If you expand the primary IPv4 range of the cluster's subnet
,
GKE does not automatically update the source range of the gke-[cluster-name]-[cluster-hash]-vms
firewall rule. Because nodes in the
cluster can receive IPv4 addresses from the expanded portion of the subnet's
primary IPv4 range, you must manually create a firewall rule to allow
communication between nodes of the cluster.
The ingress firewall rule you must create must allow TCP and ICMP packets from the expanded primary subnet IPv4 source range , and it must at least apply to all nodes in the cluster.
To create an ingress firewall rule that only applies to the cluster's nodes,
set the firewall rule's target to the same target tag used by your cluster's
automatically-created gke-[cluster-name]-[cluster-hash]-vms
firewall rule.
Rule evaluation order
If you are using firewall policies in addition to VPC firewall rules, by default, Google Cloud evaluates firewall rules prior to network firewall policies (both global and regional). If you change the rule evaluation order , then traffic might not reach your GKE clusters. For more information, see Policy and rule evaluation order .
Firewall rule logging
Firewall rule logging is disabled by default. To enable logging for a firewall
rule, use the --enable-logging
command
.
What's next
- Read an overview of networking in GKE .
- Learn about Configuring network policies for applications .
- Learn about other Pre-populated firewall rules in Google Cloud.
- Learn more about Creating firewall rules in projects that use Shared VPC.