GKE Internal Ingress for Headless Service

Question

I'm trying to create an internal ingress for inter-cluster communication with gke. The service that I'm trying to expose is headless and points to a kafka-broker on the cluster.

However when I try to load up the ingress, it says it cannot find the service?

Warning  Sync    3m22s (x17 over 7m57s)  loadbalancer-controller  Error syncing to GCP: error running load balancer syncing routine: loadbalancer coilwp7v-redpanda-test-abc123-redpanda-japm3lph does not exist: googleapi: Error 400: Invalid value for field 'resource.target': 'https://www.googleapis.com/compute/v1/projects/abc-123/regions/europe-west2/targetHttpProxies/k8s2-tp-coilwp7v-redpanda-test-abc123-redpanda-japm3lph'. A reserved and active subnetwork is required in the same region and VPC as the forwarding rule., invalid

Ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: abc-redpanda
  namespace: redpanda-test
  annotations:
    kubernetes.io/ingress.class: "gce-internal"
spec:
  defaultBackend:
    service:
      name: redpanda-service
      port:
        number: 9092

Service:

apiVersion: v1
kind: Service
metadata:
  name: redpanda-service
  namespace: redpanda-test
  annotations:
    io.cilium/global-service: "true"
    cloud.google.com/neg: '{"ingress": true}'
  labels:
    app: abc-panda
spec:
  type: ExternalName
  externalName: redpanda-cluster-0.redpanda-cluster.redpanda-test.svc.cluster.local
  ports:
    - port: 9092
      targetPort: 9092

"However when I try to load up the ingress, it says it cannot find the service?" - what makes you think so ? In the error message you get, there is nothing about the service. It says specifically: "A reserved and active subnetwork is required in the same region and VPC as the forwarding rule." Did you follow all the required steps, described here ? — mario

Gari Singh Gari Singh · Accepted Answer · 2021-06-11T11:12:44

Setting up ingress for internal load balancing requires you to configure a proxy-only subnet on the same VPC used by your GKE cluster. This subnet will be used for the load balancers proxies. You'll also need to create a fw rule to allow traffic as well.

Have a look at the prereqs for ingress and then look here for info on how to setup the proxy-only subnet for your VPC.

GKE Internal Ingress for Headless Service

Ingress:

Service:

1 Answers