gke/ERR/2021_014

GKE masters of private clusters can reach the nodes.

Product: Google Kubernetes Engine
Rule class: ERR - Something that is very likely to be wrong

Description

Nodes of private clusters must allow certain connections from the masters (tcp:443 and tcp:10250)

The GKE control plane automatically creates a firewall rule called gke-[cluster-name]-[cluster-hash]-master to allow these connections, but if the connections get blocked, the following could be the reason:

  • The firewall rules couldn’t be created (for example in a shared VPC scenario)
  • The firewall rules were disabled or deleted
  • There is a higher priority firewall rule configured for the VPC
  • There is a firewall policy at the organization or folder level which blocks these connections.

Remediation

The gcpdiag output should tell you if the connection was blocked by a firewall rule or policy.

Further information