From 81db106fad8de67bba9a170eca4a5ffb2438eaad Mon Sep 17 00:00:00 2001 From: Simon Willison Date: Mon, 28 Aug 2017 13:42:54 -0700 Subject: [PATCH] Explained the 10.200.0.0/16 subnet --- docs/01-infrastructure-gcp.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/01-infrastructure-gcp.md b/docs/01-infrastructure-gcp.md index e255f2b..3df4edf 100644 --- a/docs/01-infrastructure-gcp.md +++ b/docs/01-infrastructure-gcp.md @@ -67,7 +67,9 @@ https://cloud.google.com/compute/docs/vpc/firewalls A GCP network also acts as a firewall. By default no connections are allowed from the outside world, and connections between instances are also forbidden. We can add firewall rules to allow our instances to talk to each other within the network. -This creates a rule called `allow-internal` which allows TCP, UDP and ICMP connections between all machines in your `10.240.0.0/24` subnet, and also enables those machines to talk to the CIDR range `10.200.0.0/16`: +Kubernetes pods are assigned their own IP addresses independent of the instances ther are running on. We will be using the CIDR subnet `10.200.0.0/16` for this, configured in chapter 5 as the `--cluster-cidr` argument to `kube-controller-manager`. + +Here we create a firewall rule called `allow-internal` which allows TCP, UDP and ICMP connections between the instances in your `10.240.0.0/24` subnet, and the Kubernetes pods that will live in the `10.200.0.0/16` range. ``` gcloud compute firewall-rules create allow-internal \