Using Kubernetes Container as a Custom NAT instance?

Question

GCP used to have a documentation that explained about using Google Compute instance as a custom NAT Device, it is now deprecated and deleted as per the documentation.

Basically it had a list of commands that used sysctl and iptables commands in order to forward some traffic received to a specific destination IP.

The commands looked like below:

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination xx.xxx.xxx.xx
iptables -t nat -A POSTROUTING -j MASQUERADE

I have a working compute instance that is being used as a NAT device to forward some traffic from some IPs to a specific destination. This is done with the help of Google Cloud Routes. Example:

gcloud compute routes create $EXAMPLE-ROUTE-NAME \
    --network $NETWORK-NAME \
    --destination-range 1.1.1.1 \
    --next-hop-instance $CUSTOM-NAT-INSTANCE-NAME \
    --next-hop-instance-zone $CUSTOM-NAT-INSTANCE-ZONE \
    --tags $TAG-NAME \
    --priority 800

This way, when all the VM instance in "${NETWORK-NAME}" with the tag "$TAG-NAME" try to send a request to "1.1.1.1", this custom route forwards the traffic to "$CUSTOM-NAT-INSTANCE-NAME" and this instance acts as a NAT and forwards the traffic to "xx.xxx.xxx.xx".

I understand the concept of "Google Cloud NAT" and how easy it is to set it up, but because of some limitations, we have to use a custom NAT.

Now my question is, can we setup a custom NAT on GKE container? There is no sysctl command inside the container (as expected) and securityContext.sysctls.name: net.ipv4.ip_forward is not allowed in GKE.

Is it possible to use a Kubernetes Container as a NAT device?

Using Kubernetes Container as a Custom NAT instance?

0 Answers