如何为GCP Terraform创建的节点池中的指定节点分配预留外部IP地址？

Absolutely, you can lock a specific reserved external IP to a node in your GKE node pool. The key here is to use a custom instance template (since default GKE node pools don’t let you specify static IPs directly) and tie it to a dedicated small node pool for that single node. Here's a step-by-step breakdown with Terraform code:

Prerequisites #

• You already have a regional reserved external IP in your GCP project (make sure it’s in the same region as your GKE cluster).
• Your GKE cluster is up and running.

Step 1: Reference Your Reserved IP in Terraform #

First, pull in the existing reserved IP so Terraform can use it:

data "google_compute_address" "reserved_static_ip" {
  name    = "your-reserved-ip-name"
  project = "your-gcp-project-id"
  region  = "us-central1" # Replace with your IP's region
}

Step 2: Create a Custom Instance Template with the Static IP #

This template defines the node’s configuration, including binding it to your reserved IP. We’ll also add labels to easily identify the node later:

resource "google_compute_instance_template" "static_ip_node_template" {
  name_prefix = "gke-static-ip-node-template-"
  machine_type = "e2-medium" # Use your preferred machine type
  region       = "us-central1" # Match your cluster/IP region

  network_interface {
    network = "default" # Replace with your cluster's VPC
    access_config {
      nat_ip = data.google_compute_address.reserved_static_ip.address
    }
  }

  # Use GKE's recommended Container-Optimized OS
  disk {
    source_image = "projects/cos-cloud/global/images/family/cos-stable"
    disk_size_gb = 100
  }

  # Required metadata and service account for GKE nodes
  metadata = {
    disable-legacy-endpoints = "true"
  }

  service_account {
    email = "your-gke-node-service-account@your-project.iam.gserviceaccount.com"
    scopes = ["https://www.googleapis.com/auth/cloud-platform"]
  }

  # Labels to mark this as your static IP node
  labels = {
    node-role = "static-ip-specialist"
    static-ip = "true"
  }
}

Step 3: Create a Dedicated Node Pool for This Node #

We’ll create a small node pool (with just 1 node) that uses the custom template. This ensures only this node uses the reserved IP:

resource "google_container_node_pool" "static_ip_node_pool" {
  name     = "static-ip-node-pool"
  location = "us-central1" # Match your cluster's region/zone
  cluster  = "your-gke-cluster-name" # Replace with your cluster name
  node_count = 1

  node_config {
    instance_template = google_compute_instance_template.static_ip_node_template.self_link
    # No need to redefine machine type/OS here—it's inherited from the template
  }
}

Key Notes #

• Why a dedicated node pool? GKE manages node lifecycles (upgrades, replacements), so tying the IP to a single-node pool ensures any replacement node will automatically pick up the reserved IP (thanks to the instance template).
• Avoid conflicts: Never set node_count higher than 1 here—you can’t assign the same static IP to multiple nodes.
• Region consistency: Your reserved IP, instance template, and node pool must all be in the same region (static IPs are regional resources in GCP).

Alternative: Binding IP to an Existing Node (Not Recommended) #

If you already have a node in an existing pool and want to assign the IP to it, you can manually bind the reserved IP to the node’s VM instance. However, this is risky: if GKE replaces the node (e.g., during an upgrade), the IP will be lost. Use the custom template method above for long-term reliability.

内容的提问来源于stack exchange，提问作者NimaKapoor