Google recently announced that it will start charging fee for external IP addresses attached to VM instances. In addition to that, unless you have a need to expose your instances to the outside directly, it might be best security practice to not attach external IPs to your VMs. Thus from both security and cost perspective, you might not want to attach external IPs to your GCP nodes. But how do you ssh to instances without external IPs?
Luckily GCP provides a service to tunnel to your internal instances with Identity Aware Proxy ( IAP). This means you don’t have to deploy additional ssh jump hosts.
You will need to configure your project’s OAuth consent screen as well – https://cloud.google.com/iap/docs/using-tcp-forwarding#oauth-configure
You might want to tag instances which you want to ssh into with a common tag – say “ssh-node”.
SSH to the instance with “–tunnel-through-iap” flag
Note above, the source connecting IP shows as 35.235.241.226, that is with in the CIDR range of the IAP proxy we allowed in the firewall rule.
References
Linux System Admins Journey to Google Cloud Platform As a Linux system administrator, you have…
As a network professional, troubleshooting is a crucial part of your daily routine. To streamline…
The net-tools set of packages had been deprecated years back, although the commands are still…
Re-posting my answer to a Google cloud platform's Google Kubernetes Engine (GKE) related question in…
Recently I was trying to download numerous files from a certain website using a shell…