[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Automatically created firewall rules\n\n[Autopilot](/kubernetes-engine/docs/concepts/autopilot-overview) [Standard](/kubernetes-engine/docs/concepts/choose-cluster-mode)\n\n*** ** * ** ***\n\nThis page describes the ingress allow [VPC firewall\nrules](/vpc/docs/firewalls) that Google Kubernetes Engine (GKE) by default creates\nautomatically in Google Cloud.\n\nApplicable firewalls and egress firewalls\n-----------------------------------------\n\nGKE uses Virtual Private Cloud (VPC) firewall rules to control\nincoming and outgoing traffic to your Pods and nodes. By default,\nGKE automatically creates and manages certain firewall rules to\nallow essential traffic, such as communication between nodes and Pods, and\ntraffic to your Kubernetes control plane. While GKE automatically\ncreates ingress allow VPC firewall rules for LoadBalancer\nServices by default, you can disable this behavior to manage firewall rules or\npolicies manually or utilize advanced firewall features.\n\nIngress allow firewall rules created by GKE aren't the\nonly applicable firewall rules that apply to nodes in a cluster. The\ncomplete set of applicable firewall rules for ingress and egress is\ndefined from rules in [hierarchical firewall\npolicies](/firewall/docs/firewall-policies), [global network firewall\npolicies](/firewall/docs/network-firewall-policies), [regional network\nfirewall policies](/firewall/docs/regional-firewall-policies), and\nother VPC firewall rules.\n**Best practice** :\n\nPlan and design the\nconfiguration for your cluster, workloads and Services with your organization's\nNetwork administrators and Security engineers, and understand the firewall\n[policy and\nrule evaluation order](/firewall/docs/firewall-policies-overview#rule-evaluation) so you know which firewall rules take precedence.\n\nGKE only creates *ingress* [VPC firewall\nrules](/firewall/docs/firewalls) because GKE relies on\nthe [implied allowed egress lowest-priority firewall\nrule](/firewall/docs/firewalls#default_firewall_rules).\n\nIf you've configured egress deny firewall rules in your cluster's\nVPC network, you might have to create egress allow rules to\npermit communication between nodes, Pods, and the cluster's control plane.\nFor example, if you've created an egress deny firewall rule for all protocols\nand ports and all destination IP addresses, you must create egress allow\nfirewall rules in addition to the ingress rules that GKE\ncreates automatically. Connectivity to control plane endpoints always uses\nTCP destination port `443`, but connectivity among nodes and Pods of the\ncluster can use any protocol and destination port.\n\nThe following tools are useful to determine which firewall rules allow or\ndeny traffic:\n\n- [Connectivity Tests](/network-intelligence-center/docs/connectivity-tests/how-to/running-connectivity-tests)\n- [Firewall Rules Logging](/firewall/docs/firewall-rules-logging)\n\nFirewall rules\n--------------\n\nGKE by default creates firewall rules automatically when creating\nthe following resources:\n\n- GKE clusters\n- GKE Services\n- GKE Gateways and HTTPRoutes\n- GKE Ingresses\n\nUnless otherwise specified, the priority for all automatically\ncreated firewall rules is 1000, which is the\n[default value for firewall rules](/vpc/docs/firewalls#priority_order_for_firewall_rules).\nIf you would like more control over firewall behavior, you can create firewall\nrules with a higher\n[priority](/vpc/docs/firewalls#priority_order_for_firewall_rules).\nFirewall rules with a higher priority are applied\nbefore automatically created firewall rules.\n| **Warning:** Don't modify or delete firewall rules created by GKE. Any manual changes to these rules might be reverted, which could lead to unexpected behavior in your clusters.\n| **Note:** Evaluate all firewall rules applicable to the VM instances within a VPC, both ingress and egress. If you decide to block egress connections for clusters, you must ensure that appropriate firewall rules exist to allow nodes to communicate with the control plane on TCP port 443. If you are using `Konnectivity` proxy and blocking all egress traffic, ensure there is a rule with higher priority that allows traffic on port 8132.\n\n### GKE cluster firewall rules\n\nGKE creates the following ingress firewall rules when creating a\ncluster:\n\n### GKE Service firewall rules\n\nGKE creates the following ingress firewall rules when creating a\n[Service](/kubernetes-engine/docs/concepts/service). You can prevent some of\nthese firewall rules from being created by [managing VPC\nfirewall rules creation](#manage-firewall-rule-creation).\n\n### GKE Gateway firewall rules\n\nGKE creates the following Gateway firewall rules when creating a\n[Gateway](/kubernetes-engine/docs/concepts/gateway-api#gateway) and\n[HTTPRoute](/kubernetes-engine/docs/concepts/gateway-api#httproute) resources:\n\n### GKE Ingress firewall rules\n\nGKE creates the following Ingress firewall rules when creating an\n[Ingress](/kubernetes-engine/docs/concepts/ingress) resource:\n\nManage VPC firewall rules creation\n----------------------------------\n\nBy default, GKE automatically creates ingress allow VPC\nfirewall rules for all LoadBalancer Services. If you want to manage firewall rules\nfor LoadBalancer Services yourself, you must disable the automatic creation of\nVPC firewall rules.\n\nDisabling the automatic creation of VPC firewall rules for LoadBalancer\nServices only applies to the following:\n\n- [Internal LoadBalancer Services using GKE subsetting](/kubernetes-engine/docs/how-to/internal-load-balancing)\n- [Backend service-based external LoadBalancer Services](/kubernetes-engine/docs/how-to/backend-service-based-external-load-balancer)\n\nFor information on how to disable firewall rules, see [User-managed firewall\nrules for GKE LoadBalancer\nServices](/kubernetes-engine/docs/how-to/user-managed-firewall-rules).\n\nShared VPC\n----------\n\nIf you're using Ingress or LoadBalancer Services, and you have a cluster that is\nlocated in a Shared VPC using a Shared VPC network, the\nGKE service account in the service project can't create and update\ningress allow firewall rules in the host project. You can grant the\nGKE service account in a service project permissions to create\nand manage the firewall resources. For more information, see\n[Shared VPC](/kubernetes-engine/docs/concepts/ingress#shared_vpc).\n| **Note:** In case of GKE Gateway, the firewall rules are not automatically deployed. You need to manually create the firewall rules in order for health checks to succeed.\n\nRequired firewall rule for expanded subnet\n------------------------------------------\n\nIf you\n[expand the primary IPv4 range of the cluster's subnet](/vpc/docs/create-modify-vpc-networks#expand-subnet),\nGKE does not automatically update the source range of the\n`gke-[cluster-name]-[cluster-hash]-vms` firewall rule. Because nodes in the\ncluster can receive IPv4 addresses from the expanded portion of the subnet's\nprimary IPv4 range, you must manually create a firewall rule to allow\ncommunication between nodes of the cluster.\n\nThe ingress firewall rule you must create must allow TCP and ICMP packets *from\nthe expanded primary subnet IPv4 source range*, and it must at least apply to\nall nodes in the cluster.\n\nTo create an ingress firewall rule that only applies to the cluster's nodes,\nset the firewall rule's target to the same target tag used by your cluster's\nautomatically-created `gke-[cluster-name]-[cluster-hash]-vms` firewall rule.\n\nWhat's next\n-----------\n\n- Read an overview of [networking in GKE](/kubernetes-engine/docs/concepts/network-overview).\n- Learn about [Configuring network policies for applications](/kubernetes-engine/docs/tutorials/network-policy).\n- Learn about other [Pre-populated firewall rules](/vpc/docs/firewalls#more_rules_default_vpc) in Google Cloud.\n- Learn more about [Creating firewall rules](/kubernetes-engine/docs/how-to/cluster-shared-vpc#creating_firewall_rules) in projects that use Shared VPC."]]
