This page describes the ingress allowVPC firewallrules that Google Kubernetes Engine (GKE) by default createsautomatically in Google Cloud.

Applicable firewalls and egress firewalls

GKE uses Virtual Private Cloud (VPC) firewall rules to controlincoming and outgoing traffic to your Pods and nodes. By default,GKE automatically creates and manages certain firewall rules toallow essential traffic, such as communication between nodes and Pods, andtraffic to your Kubernetes control plane. While GKE automaticallycreates ingress allow VPC firewall rules for LoadBalancerServices by default, you can disable this behavior to manage firewall rules orpolicies manually or utilize advanced firewall features.

Ingress allow firewall rules created by GKE aren't theonly applicable firewall rules that apply to nodes in a cluster. Thecomplete set of applicable firewall rules for ingress and egress isdefined from rules inhierarchical firewallpolicies,global network firewallpolicies,regional networkfirewall policies, andother VPC firewall rules.

GKE only createsingressVPC firewallrules because GKE relies ontheimplied allowed egress lowest-priority firewallrule.

If you've configured egress deny firewall rules in your cluster'sVPC network, you might have to create egress allow rules topermit communication between nodes, Pods, and the cluster's control plane.For example, if you've created an egress deny firewall rule for all protocolsand ports and all destination IP addresses, you must create egress allowfirewall rules in addition to the ingress rules that GKEcreates automatically. Connectivity to control plane endpoints always usesTCP destination port443, but connectivity among nodes and Pods of thecluster can use any protocol and destination port.

The following tools are useful to determine which firewall rules allow ordeny traffic:

• Connectivity Tests
• Firewall Rules Logging

Firewall rules

GKE by default creates firewall rules automatically when creatingthe following resources:

• GKE clusters
• GKE Services
• GKE Gateways and HTTPRoutes
• GKE Ingresses

Unless otherwise specified, the priority for all automaticallycreated firewall rules is 1000, which is thedefault value for firewall rules.If you would like more control over firewall behavior, you can create firewallrules with a higherpriority.Firewall rules with a higher priority are appliedbefore automatically created firewall rules.

GKE creates the following ingress firewall rules when creating aService. You can prevent some ofthese firewall rules from being created bymanaging VPCfirewall rules creation.

GKE Gateway firewall rules

GKE creates the following Gateway firewall rules when creating aGateway andHTTPRoute resources:

GKE Ingress firewall rules

GKE creates the following Ingress firewall rules when creating anIngress resource:

Manage VPC firewall rules creation

By default, GKE automatically creates ingress allow VPCfirewall rules for all LoadBalancer Services. If you want to manage firewall rulesfor LoadBalancer Services yourself, you must disable the automatic creation ofVPC firewall rules.

Disabling the automatic creation of VPC firewall rules for LoadBalancerServices only applies to the following:

• Internal LoadBalancer Services using GKE subsetting
• Backend service-based external LoadBalancer Services

For information on how to disable firewall rules, seeUser-managed firewallrules for GKE LoadBalancerServices.

Shared VPC

If you're using Ingress or LoadBalancer Services, and you have a cluster that islocated in a Shared VPC using a Shared VPC network, theGKE service account in the service project can't create and updateingress allow firewall rules in the host project. You can grant theGKE service account in a service project permissions to createand manage the firewall resources. For more information, seeShared VPC.

If youexpand the primary IPv4 range of the cluster's subnet,GKE does not automatically update the source range of thegke-[cluster-name]-[cluster-hash]-vms firewall rule. Because nodes in thecluster can receive IPv4 addresses from the expanded portion of the subnet'sprimary IPv4 range, you must manually create a firewall rule to allowcommunication between nodes of the cluster.

The ingress firewall rule you must create must allow TCP and ICMP packetsfromthe expanded primary subnet IPv4 source range, and it must at least apply toall nodes in the cluster.

To create an ingress firewall rule that only applies to the cluster's nodes,set the firewall rule's target to the same target tag used by your cluster'sautomatically-createdgke-[cluster-name]-[cluster-hash]-vms firewall rule.

What's next

• Read an overview ofnetworking in GKE.
• Learn aboutConfiguring network policies for applications.
• Learn about otherPre-populated firewall rulesin Google Cloud.
• Learn more aboutCreating firewall rulesin projects that use Shared VPC.