Add authorized networks for control plane access

This page shows you how to use authorized networks to restrict the origins from where you can access the control planes of your Google Kubernetes Engine (GKE) clusters. Authorized networks grant control plane access to a specific set of trusted IP addresses, and provide protection and additional security benefits for your GKE cluster.

How authorized networks work

Authorized networks provide an IP-based firewall that controls access to the GKE control plane. The access to the control plane depends on the type of GKE cluster and the source IP addresses. With authorized networks, you configure the IP addresses you want to allow access to the GKE cluster's control plane endpoint as a CIDR block list.

Terminology related to clusters and IP addresses

The following terms are used to differentiate which IP-based firewall rules are in place, depending on your type of cluster:

IP addresses distinctions:

• Public IP addresses of all Compute Engine VMs in Google Cloud: Public IP addresses assigned to any VM used by any customer hosted on Google Cloud. Google Cloud owns these IP addresses. To learn more, see Where can I find Compute Engine IP ranges?
• Google Cloud platform IP addresses: IP addresses used by Google Cloud products such as Cloud Run or Cloud Run functions. Any client hosted on Google Cloud can instantiate these IP addresses. Google Cloud owns these IP addresses.
• Google-reserved IP addresses: Public IP addresses for GKE cluster management purposes. These IP addresses include GKE managed processes and other production Google services. Google owns these IP addresses.
• Internet public IP addresses: Non-RFC 1918 and non-Google public IP addresses. Neither Google nor Google Cloud products own these public IP addresses.
• GKE cluster IP address ranges: IP addresses assigned to the cluster that GKE uses for the cluster's nodes, Pods, and Services.
• Privately used IP addresses: IP addresses from your cluster's VPC network. These IP addresses can include your cluster IP address, on-premises networks, the RFC 1918 ranges, or the privately used public IP (PUPI) addresses that include non-RFC 1918 ranges.

Cluster types:

• Legacy public clusters: Public clusters running on legacy networks or VPC networks with public IP addresses assigned to nodes, and that have not been migrated to Private Service Connect architecture.
• Legacy private clusters: Clusters based on VPC Network Peering for control plane connectivity from nodes with private IP addresses only.
• PSC-based cluster created as public or private: Clusters that use Private Service Connect architecture for the communication between the GKE cluster control plane and nodes. To determine if your cluster uses Private Service Connect, see the GKE control plane.

Access to control plane endpoints

The following table shows the default authorized network status at cluster creation. Based on the type of GKE cluster and control plane endpoint, you can determine the following:

• The preset IP addresses that can always access the GKE control plane.
• The IP addresses that you can configure to access the cluster's control plane with authorized networks enabled.

The configurable IP addresses can access the cluster's control plane when you allowlist them and enable authorized networks.

Limitations

• If you expand a subnet that is used by a cluster with authorized networks, you must update the authorized network configuration to include the expanded IP address range.

• The number of authorized IP address ranges you can specify for public and private IP addresses depends on the type of cluster:

  • Public cluster: 50 IP address ranges
  • Private cluster: 100 IP address ranges
  • PSC-based clusters: 100 IP address ranges

Before you begin

Before you start, make sure you have performed the following tasks:

• Enable the Google Kubernetes Engine API.
Enable Google Kubernetes Engine API
• If you want to use the Google Cloud CLI for this task, install and then initialize the gcloud CLI. If you previously installed the gcloud CLI, get the latest version by running gcloud components update.

Create a cluster with authorized networks

You can create a cluster with one or more authorized networks by using the Google Cloud CLI, the Google Cloud console, or the GKE API.

gcloud container clusters create-auto CLUSTER_NAME \
    --enable-master-authorized-networks \
    --master-authorized-networks CIDR1,CIDR2,...

"masterAuthorizedNetworksConfig": {
  "enabled": true,
  "cidrBlocks": [
    {
      "displayName": string,
      "cidrBlock": string
    }
  ]
}

You can configure a private cluster with one or more authorized networks. For more information, see Private clusters.

Create a cluster with limited control plane access

GKE assigns a public IP address (external endpoint) to the control plane in public clusters. You can set further cluster isolation on public clusters that use Private Service Connect to privately connect nodes and control plane. To check if your cluster uses Private Service Connect, see Public clusters with Private Service Connect.

You can create a cluster and instruct GKE to block access from the following origins to the control plane:

• From IP addresses owned by Google Cloud.
• From external IP addresses, except from Google Services that run cluster management processes.

You can create a cluster and define control plane access by using the Google Cloud CLI or the Google Cloud console.

gcloud container clusters create-auto CLUSTER_NAME
    --no-enable-google-cloud-access

Add an authorized network to an existing cluster

You can add an authorized network to an existing cluster using the gcloud CLI or the Google Cloud console.

gcloud container clusters update CLUSTER_NAME \
    --enable-master-authorized-networks \
    --master-authorized-networks CIDR1,CIDR2,...

"desiredMasterAuthorizedNetworksConfig": {
    object(MasterAuthorizedNetworksConfig)
  }

Verify an authorized network

You can verify an authorized network in an existing cluster using the gcloud CLI or the Google Cloud console.

gcloud container clusters describe CLUSTER_NAME

...
masterAuthorizedNetworksConfig:
  cidrBlocks:
  - cidrBlock: 8.8.8.8/32
  - cidrBlock: 8.8.4.4/32
  enabled: true
...

"masterAuthorizedNetworksConfig": {
"enabled": true,
 "cidrBlocks": [
  {
    "displayName": "Office",
    "cidrBlock": "192.0.2.0/24"
  }
]
}

Disable authorized networks

You can disable authorized networks for an existing cluster using the gcloud CLI or the Google Cloud console.

gcloud container clusters update CLUSTER_NAME \
  --no-enable-master-authorized-networks

Remove authorized networks

gcloud container clusters update CLUSTER_NAME \
    --enable-master-authorized-networks

Troubleshooting

The following sections explain how to resolve common issues with authorized networks.

Too many CIDR blocks

gcloud returns the following error when attempting to create or update a cluster with more than 50 CIDR blocks:

ERROR: (gcloud.container.clusters.update) argument --master-authorized-networks: too many args

To resolve this issue, if your cluster is public, ensure that you specify no more than 50 CIDR blocks. If your cluster is private, specify no more than 100 CIDR blocks.

Unable to connect to the server

kubectl commands time out due to incorrectly configured CIDR blocks:

Unable to connect to the server: dial tcp MASTER_IP: getsockopt: connection timed out

When you create or update a cluster, ensure that you specify the correct CIDR blocks.

What's next

• Read the GKE network overview.
• Learn about VPC-native clusters.
• Learn about firewall rules.
• Learn how to create private clusters.