Change:
From GCE email today: Current behavior: You are not required to add firewall rules for Network LB health checks today Action required: We are introducing three new ranges for health checking: 209.85.152.0/22, 209.85.204.0/22, and 35.191.0.0/16. You need to ensure that your firewall allows traffic from 209.85.152.0/22, 209.85.204.0/22, and 35.191.0.0/16. The health check probes to your backend instances will come from one of these ranges. We have until Jan 31, 2018 - 1 year.
/assign this issue explains the confusion I had several weeks ago when speaking with and you about L4 health checks. I didn't realize a firewall rule isn't currently required.
/assign
Is this done now?
Not yet, there is a WIP on .
/close

Discussion:
clientset-path cloud-config cloud-provider <ins> cloud-provider-gce-lb-src-cidrs </ins> cluster-cidr cluster-context cluster-dns

package gce import ( <ins> "flag" </ins> "fmt" <ins> "net" </ins> "net/http" "sort" "strconv"

compute "google.golang.org/api/compute/v1" ) <ins> type cidrs struct { ipn   netsets.IPNet isSet bool } var lbSrcRngsFlag cidrs func init() { var err error lbSrcRngsFlag.ipn, err = netsets.ParseIPNets([]string{"130.211.0.0/22", "35.191.0.0/16", "209.85.152.0/22", "209.85.204.0/22", "35.191.0.0/16"}...) if err != nil { panic("Incorrect default GCE L7 source ranges") } flag.Var(&lbSrcRngsFlag, "cloud-provider-gce-lb-src-cidrs", "CIDRS opened in GCE firewall for LB traffic proxy & health checks") } // String is the method to format the flag's value, part of the flag.Value interface. func (c *cidrs) String() string { return strings.Join(c.ipn.StringSlice(), ",") } // Set supports a value of CSV or the flag repeated multiple times func (c *cidrs) Set(value string) error { // On first Set(), clear the original defaults if !c.isSet { c.isSet = true c.ipn = make(netsets.IPNet) } else { return fmt.Errorf("GCE LB CIDRS have already been set") } for _, cidr := range strings.Split(value, ",") { _, ipnet, err := net.ParseCIDR(cidr) if err != nil { return err } c.ipn.Insert(ipnet) } return nil } // LoadBalancerSrcRanges contains the ranges of ips used by the GCE load balancers (l4 & L7) // for proxying client requests and performing health checks. func LoadBalancerSrcRanges() []string { return lbSrcRngsFlag.ipn.StringSlice() } </ins> // GetLoadBalancer is an implementation of LoadBalancer.GetLoadBalancer func (gce *GCECloud) GetLoadBalancer(clusterName string, service *v1.Service) (*v1.LoadBalancerStatus, bool, error) { loadBalancerName := cloudprovider.GetLoadBalancerName(service)

// Name of the default http backend service defaultBackendName = "default-http-backend" <del> // GCEL7SrcRange is the IP src range from which the GCE L7 performs health checks. GCEL7SrcRange = "130.211.0.0/22" </del> // Cloud resources created by the ingress controller older than this // are automatically purged to prevent running out of quota. // TODO(37335): write soak tests and bump this up to a week.

fw := compute.Firewall{} fw.Name = gceController.GetFirewallRuleName() <del> fw.SourceRanges = []string{GCEL7SrcRange} </del> <ins> fw.SourceRanges = gcecloud.LoadBalancerSrcRanges() </ins> fw.TargetTags = nodeTags.Items fw.Allowed = []*compute.FirewallAllowed{ {