【GKE再入門】GKE Autopilotクラスタ上にNginxをデプロイしてGlobal external Application Load Balancer経由で外部からアクセスしてみた

spec:
  replicas: 2            # Pod を 2 つ維持
  selector:
    matchLabels:
      app: nginx          # このラベルを持つ Pod を管理対象とする
  template:
    metadata:
      labels:
        app: nginx        # Pod に付与するラベル（selector と一致させる）
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - containerPort: 80

spec:
  type: ClusterIP
  selector:
    app: nginx        # app=nginx ラベルを持つ Pod にトラフィックを転送
  ports:
  - port: 80          # Service が受け付けるポート
    targetPort: 80    # Pod 内コンテナのポートへ転送

# Gateway: ロードバランサーのフロントエンド定義
spec:
  gatewayClassName: gke-l7-global-external-managed  # Global ALB を使用
  listeners:
  - name: http
    protocol: HTTP
    port: 80
---
# HTTPRoute: ルーティングルール
spec:
  parentRefs:
  - name: nginx-gateway       # この Gateway にアタッチ
  rules:
  - backendRefs:
    - name: nginx-service      # すべてのリクエストをこの Service に転送
      port: 80

# プロジェクトIDとリージョンを設定
export PROJECT_ID=YOUR_PROJECT_ID
export REGION=asia-northeast1
export CLUSTER_NAME=nginx-autopilot-cluster
export NETWORK_NAME=nginx-demo-network
export SUBNET_NAME=nginx-demo-subnet
export ROUTER_NAME=nginx-demo-router
export NAT_NAME=nginx-demo-nat

# 必要な API を有効化
gcloud services enable compute.googleapis.com \
  container.googleapis.com \
  --project=$PROJECT_ID

Operation "operations/acf.p2-xxxxxxxxxxxx-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" finished successfully.

# VPC ネットワークを作成
gcloud compute networks create $NETWORK_NAME \
    --subnet-mode=custom \
    --project=$PROJECT_ID

Created [https://www.googleapis.com/compute/v1/projects/YOUR_PROJECT_ID/global/networks/nginx-demo-network].
NAME: nginx-demo-network
SUBNET_MODE: CUSTOM
BGP_ROUTING_MODE: REGIONAL
IPV4_RANGE: 
GATEWAY_IPV4: 
INTERNAL_IPV6_RANGE: 

Instances on this network will not be reachable until firewall rules
are created. As an example, you can allow all internal traffic between
instances as well as SSH, RDP, and ICMP by running:

$ gcloud compute firewall-rules create <FIREWALL_NAME> --network nginx-demo-network --allow tcp,udp,icmp --source-ranges <IP_RANGE>
$ gcloud compute firewall-rules create <FIREWALL_NAME> --network nginx-demo-network --allow tcp:22,tcp:3389,icmp

# サブネットを作成（Pod・サービス用のセカンダリ範囲を含む）
gcloud compute networks subnets create $SUBNET_NAME \
    --network=$NETWORK_NAME \
    --region=$REGION \
    --range=10.0.0.0/20 \
    --secondary-range=pods=10.4.0.0/14,services=10.8.0.0/20 \
    --project=$PROJECT_ID

Created [https://www.googleapis.com/compute/v1/projects/YOUR_PROJECT_ID/regions/asia-northeast1/subnetworks/nginx-demo-subnet].
NAME: nginx-demo-subnet
REGION: asia-northeast1
NETWORK: nginx-demo-network
RANGE: 10.0.0.0/20
STACK_TYPE: IPV4_ONLY
IPV6_ACCESS_TYPE: 
INTERNAL_IPV6_PREFIX: 
EXTERNAL_IPV6_PREFIX: 

# Cloud Router を作成
gcloud compute routers create $ROUTER_NAME \
    --network=$NETWORK_NAME \
    --region=$REGION \
    --project=$PROJECT_ID

Creating router [nginx-demo-router]...done.                                                                                                                                                   
NAME: nginx-demo-router
REGION: asia-northeast1
NETWORK: nginx-demo-network

# Cloud NAT を作成
gcloud compute routers nats create $NAT_NAME \
    --router=$ROUTER_NAME \
    --region=$REGION \
    --auto-allocate-nat-external-ips \
    --nat-all-subnet-ip-ranges \
    --project=$PROJECT_ID

Creating NAT [nginx-demo-nat] in router [nginx-demo-router]...done. 

# GKE Autopilot クラスタの作成
gcloud container clusters create-auto $CLUSTER_NAME \
    --location=$REGION \
    --network=$NETWORK_NAME \
    --subnetwork=$SUBNET_NAME \
    --cluster-secondary-range-name=pods \
    --services-secondary-range-name=services \
    --enable-private-nodes \
    --project=$PROJECT_ID

Note: This cluster has private nodes. If you need connectivity to the public internet, for example to pull public containers, you must configure Cloud NAT. To enable NAT for the network of this cluster, run the following commands: 
gcloud compute routers create my-router --region asia-northeast1 --network default --project=YOUR_PROJECT_ID 
gcloud beta compute routers nats create nat --router=my-router --region=asia-northeast1 --auto-allocate-nat-external-ips --nat-all-subnet-ip-ranges --project=YOUR_PROJECT_ID
Creating cluster nginx-autopilot-cluster in asia-northeast1... Cluster is being health-checked (Kubernetes Control Plane is healthy)...done.                                                  
Created [https://container.googleapis.com/v1/projects/YOUR_PROJECT_ID/zones/asia-northeast1/clusters/nginx-autopilot-cluster].
To inspect the contents of your cluster, go to: https://console.cloud.google.com/kubernetes/workload_/gcloud/asia-northeast1/nginx-autopilot-cluster?project=YOUR_PROJECT_ID
kubeconfig entry generated for nginx-autopilot-cluster.
NAME: nginx-autopilot-cluster
LOCATION: asia-northeast1
MASTER_VERSION: 1.35.6-gke.1641000
MASTER_IP: xx.xxx.xx.xxx
MACHINE_TYPE: ek-standard-8
NODE_VERSION: 1.35.6-gke.1641000
NUM_NODES: 3
STATUS: RUNNING
STACK_TYPE: IPV4

# kubectl の認証情報を取得
gcloud container clusters get-credentials $CLUSTER_NAME \
    --location=$REGION \
    --project=$PROJECT_ID

Fetching cluster endpoint and auth data.
kubeconfig entry generated for nginx-autopilot-cluster.

# 現在の context を確認
kubectl config current-context

gke_YOUR_PROJECT_ID_asia-northeast1_nginx-autopilot-cluster

# Autopilot モードの確認
gcloud container clusters describe $CLUSTER_NAME \
    --location=$REGION \
    --project=$PROJECT_ID \
    --format="value(autopilot.enabled)"

True

cat <<'EOF' | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - containerPort: 80
        readinessProbe:
          httpGet:
            path: /
            port: 80
          initialDelaySeconds: 5
          periodSeconds: 10
EOF

Warning: autopilot-default-resources-mutator:Autopilot updated Deployment default/nginx-deployment: defaulted unspecified 'cpu' resource for containers [nginx] (see http://g.co/gke/autopilot-defaults).
deployment.apps/nginx-deployment created

kubectl get pods -l app=nginx

NAME                                READY   STATUS    RESTARTS   AGE
nginx-deployment-6fddd4d468-2cqwx   1/1     Running   0          70s
nginx-deployment-6fddd4d468-85m9l   1/1     Running   0          70s

cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
  namespace: default
spec:
  type: ClusterIP
  selector:
    app: nginx
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
EOF

service/nginx-service created

cat <<'EOF' | kubectl apply -f -
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: nginx-gateway
  namespace: default
spec:
  gatewayClassName: gke-l7-global-external-managed
  listeners:
  - name: http
    protocol: HTTP
    port: 80
    allowedRoutes:
      namespaces:
        from: Same
EOF

gateway.gateway.networking.k8s.io/nginx-gateway created

cat <<'EOF' | kubectl apply -f -
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: nginx-httproute
  namespace: default
spec:
  parentRefs:
  - name: nginx-gateway
  rules:
  - backendRefs:
    - name: nginx-service
      port: 80
EOF

httproute.gateway.networking.k8s.io/nginx-httproute created

kubectl get gateway nginx-gateway

NAME            CLASS                            ADDRESS          PROGRAMMED   AGE
nginx-gateway   gke-l7-global-external-managed   xxx.xxx.xxx.xxx                2m3s

kubectl wait --for=condition=Programmed gateway/nginx-gateway --timeout=300s

gateway.gateway.networking.k8s.io/nginx-gateway condition met

kubectl get gateway nginx-gateway
NAME            CLASS                            ADDRESS          PROGRAMMED   AGE
nginx-gateway   gke-l7-global-external-managed   xxx.xxx.xxx.xxx   True         4m12s

# Gateway の外部 IP を取得
GATEWAY_IP=$(kubectl get gateway nginx-gateway -o jsonpath='{.status.addresses[0].value}')

# curl でアクセス
curl http://${GATEWAY_IP}/

<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, nginx is successfully installed and working.
Further configuration is required for the web server, reverse proxy, 
API gateway, load balancer, content cache, or other features.</p>

<p>For online documentation and support please refer to
<a href="https://nginx.org/">nginx.org</a>.<br/>
To engage with the community please visit
<a href="https://community.nginx.org/">community.nginx.org</a>.<br/>
For enterprise grade support, professional services, additional 
security features and capabilities please refer to
<a href="https://f5.com/nginx">f5.com/nginx</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

# バックエンドサービスの一覧を確認
gcloud compute backend-services list \
  --project=$PROJECT_ID

NAME: gkegw1-vac7-default-gw-serve404-80-8zjp3d8cqfsu
BACKENDS: 
PROTOCOL: HTTP

NAME: gkegw1-vac7-default-gw-serve500-80-iuaooq9vq8f6
BACKENDS: 
PROTOCOL: HTTP

NAME: gkegw1-vac7-default-nginx-service-80-6nogpxd8beyn
BACKENDS: asia-northeast1-b/networkEndpointGroups/k8s1-245b1ac3-default-nginx-service-80-0f49dc9e
PROTOCOL: HTTP

# NEG の一覧を確認
gcloud compute network-endpoint-groups list \
  --project=$PROJECT_ID

NAME: k8s1-245b1ac3-default-nginx-service-80-0f49dc9e
LOCATION: asia-northeast1-b
ENDPOINT_TYPE: GCE_VM_IP_PORT
SIZE: 2

# ヘルスチェックのステータスを確認
gcloud compute backend-services get-health gkegw1-vac7-default-nginx-service-80-6nogpxd8beyn \
  --global \
  --project=$PROJECT_ID

backend: https://www.googleapis.com/compute/v1/projects/YOUR_PROJECT_ID/zones/asia-northeast1-b/networkEndpointGroups/k8s1-245b1ac3-default-nginx-service-80-0f49dc9e
status:
  healthStatus:
  - healthState: HEALTHY
    instance: https://www.googleapis.com/compute/v1/projects/YOUR_PROJECT_ID/zones/asia-northeast1-b/instances/gk3-nginx-autopilot-cluster-pool-1-xxxxxxxx-xxxx
    ipAddress: 10.4.0.5
    port: 80
  - healthState: HEALTHY
    instance: https://www.googleapis.com/compute/v1/projects/YOUR_PROJECT_ID/zones/asia-northeast1-b/instances/gk3-nginx-autopilot-cluster-pool-1-xxxxxxxx-xxxx
    ipAddress: 10.4.0.13
    port: 80
  kind: compute#backendServiceGroupHealth