
## TL;DR

- DNS-based GKE endpoints change how public and private control planes can be accessed externally and internally in Google Cloud.
- Private GKE endpoints with internal IPs can now be accessed externally using a DNS-based endpoint—no need for bastion hosts or VPNs.
- Public GKE endpoints can be hardened by layering Cloud IAM authorization on API server requests.
- No other cloud provider offers secure external access to private cluster endpoints.
- DNS-based access works today via gcloud or Terraform on new/existing GKE clusters.

## Background: GKE Cluster Endpoint Models

Traditionally, GKE API servers are accessed via IP-based endpoints:

- Public IP: Globally accessible, optionally restricted via Master Authorized Networks.
- Private IP: Internal-only, routable within VPC. Requires VPN, Interconnect, or bastion host.

## Introducing DNS-Based Endpoints

DNS-based GKE endpoints offer access to the control plane using a cluster-unique FQDN, e.g.:

`gke-xxxxx-xxxxx.europe-west2.gke.google`

This FQDN resolves to a Google Cloud IP, which fronts the GKE API server. This adds an authorization layer via Cloud IAM before requests hit the Kubernetes API server.

Works with both public and private GKE endpoints.

## Architectural Implications

Before:

- Private endpoints required private networking (VPN/Interconnect/Bastion).
- Public endpoints exposed clusters to external traffic directly.

After:

- Private GKE clusters can now be accessed externally via FQDN + IAM auth.
- Public GKE clusters benefit from IAM-based filtering before RBAC applies.

## Authorisation via IAM

Traditional IP-based GKE access:

- Requests go straight to the API server.
- Access restricted via IP + RBAC.

DNS-based endpoint:

- Requests first go through a Google Cloud API.
- IAM checks are enforced, e.g., container.clusters.connect permission.
- Then forwarded to GKE control plane for RBAC enforcement.

```bash
# Grant IAM access
$ gcloud projects add-iam-policy-binding devops-mo \
  --member=serviceAccount:gke-priv-access@devops-mo.iam.gserviceaccount.com \
  --role=roles/container.developer

# Retrieve credentials via DNS endpoint
$ gcloud container clusters get-credentials gke-dns-private \
  --dns-endpoint \
  --location europe-west2
```

IAM failure example

```bash
$ kubectl cluster-info
Error: Permission 'container.clusters.connect' denied on resource
```

Benefits of DNS Endpoint Access

Private Clusters

- No VPNs or bastion hosts required
- Access internal-only GKE API servers using external connectivity
- Removes attack surfaces and infra overhead

Public Clusters

- Enforce IAM on public endpoint traffic
- Block unauthenticated users from reaching /healthz, /version, and discovery APIs

Without DNS Endpoint:

```bash
$ curl -k https://<public-ip>/readyz
$ curl -k https://<public-ip>/version
# Both return 200 OK
```

With DNS Endpoint:

```bash
$ curl -k https://gke-dns-private.europe-west2.gke.google/readyz
$ curl -k https://gke-dns-private.europe-west2.gke.google/version
# Both return 403 Forbidden
```

## Example: Deploying a Private GKE Cluster

Create Private GKE Cluster with DNS Endpoint

```bash
gcloud container clusters create-auto gke-dns-private \
  --enable-dns-access \
  --enable-private-nodes \
  --enable-private-endpoint \
  --location europe-west2 \
  --enable-master-authorized-networks
```

Inspect Cluster Networking

```bash
# Shows internal IP only
$ gcloud container clusters describe example-auto-priv --location europe-west2 --format="value(endpoint)"
10.154.0.13

# Shows FQDN
$ gcloud container clusters describe example-auto-priv --location europe-west2 --format="value(controlPlaneEndpointsConfig.dnsEndpointConfig.endpoint)"
gke-<hash>.europe-west2.gke.goog

# Resolve DNS
$ dig +short gke-<hash>.europe-west2.gke.goog
216.239.32.27
```

Try Direct Internal IP (fails externally)

```bash
$ kubectl config view -o jsonpath='{.clusters[0].cluster.server}'
https://10.154.0.13
$ kubectl get ns
# fails: timeout or unreachable
```

Use FQDN with External Access

```bash
$ gcloud container clusters get-credentials example-auto-priv \
  --dns-endpoint \
  --location europe-west2

$ kubectl cluster-info
Kubernetes control plane is running at https://gke-<hash>.europe-west2.gke.google
```

Public Endpoint Abuse vs IAM Gatekeeping

Problem:

Even restricted public endpoints expose cluster version and health APIs to unauthenticated users.

```bash
# Anonymous access
$ curl -k https://<public-ip>/readyz
$ curl -k https://<public-ip>/version
```

Authenticated (but external) users can access discovery APIs

```bash
$ kubectl auth whoami
Username: mo@devops.com
$ kubectl get --raw='/apis'
# Returns API groups
```

With DNS endpoint enabled:

```bash
$ curl -k https://<fqdn>/version
Error: Permission 'container.clusters.connect' denied
```

Migrating Existing Clusters

```bash
gcloud container clusters update example-auto-priv \
  --enable-dns-access \
  --enable-private-nodes \
  --enable-private-endpoint \
  --location europe-west2
```

or via Terraform;

```hcl
resource "google_container_cluster" "dns_private" {
  name     = "gke-priv-dns"
  enable_autopilot = true

  control_plane_endpoints_config {
    dns_endpoint_config {
      allow_external_traffic = true
    }
  }

  master_authorized_networks_config {}

  private_cluster_config {
    enable_private_nodes = true
    enable_private_endpoint = true
  }
}
# Non-destructive: Can be added to existing clusters.
```


Wrap Up

DNS-based GKE endpoints:

- Enable external access to private clusters without VPNs/bastions
- Secure public endpoints by adding IAM authorization
- Reduce infra complexity and operational overhead
- Eliminate attack surfaces from bastions and public IPs

A clear evolution from IP-based perimeter security to identity-based secure access using Google Cloud’s APIs.
- Similar to Identity-Aware Proxy (IAP), DNS-based endpoints shift access control to the cloud perimeter.

Use DNS endpoints now to modernise your GKE networking and improve your security posture.


Using GKE DNS-based endpoints for Secure cluster access


![Kafka on K8s screenshot](/images/example.png)

# Deploying Kafka on Kubernetes with Strimzi

In this article, we'll walk through deploying an Apache Kafka cluster on a local Kubernetes cluster using [Kind](https://kind.sigs.k8s.io/) (Kubernetes in Docker). We'll use the [Strimzi operator](https://strimzi.io/) for Kafka, which simplifies the deployment and management of Kafka on Kubernetes. We'll also touch on how you could incorporate Terraform to manage some of the setup or perform upgrades.

## Prerequisites

- **Docker Desktop** installed
- **Kind** installed
- **kubectl** installed

## 1. Create a Local Kubernetes Cluster with Kind

First, create a Kind cluster. For a simple default cluster:

```bash
kind create cluster --name kafka-demo
```

Verify your cluster:

```bash
kubectl cluster-info --context kind-kafka-demo
```


## 2. Install the Strimzi Operator

2.1 Using kubectl
Strimzi provides YAML manifests you can apply directly:

```bash
# Download the Strimzi installation YAML
curl -L "https://github.com/strimzi/strimzi-kafka-operator/releases/download/0.34.0/strimzi-cluster-operator-0.34.0.yaml" -o strimzi.yaml
```

# Apply to your cluster

```bash
kubectl create namespace kafka
kubectl apply -f strimzi.yaml -n kafka
```

## 2.2 Using Helm (Optional)

```bash
helm repo add strimzi https://strimzi.io/charts/
helm repo update
helm install strimzi-kafka-operator strimzi/strimzi-kafka-operator --namespace kafka --create-namespace
```

## 1. Deploy a Kafka Cluster

Create a kafka-cluster.yaml file:

```yaml
apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: my-kafka-cluster
  namespace: kafka
spec:
  kafka:
    replicas: 3
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
    storage:
      type: ephemeral
  zookeeper:
    replicas: 3
    storage:
      type: ephemeral
  entityOperator:
    topicOperator: {}
    userOperator: {}
```

```
kubectl apply -f kafka-cluster.yaml -n kafka
```

Strimzi will spin up your Kafka brokers and Zookeeper pods.


## 1. Verifying Kafka

Once the operator has created the Kafka cluster, check your pods:

```bash

kubectl get pods -n kafka

You should see:
```bash
                                   READY   STATUS    RESTARTS   AGE
my-kafka-cluster-kafka-0                1/1     Running   0          2m
my-kafka-cluster-kafka-1                1/1     Running   0          2m
my-kafka-cluster-kafka-2                1/1     Running   0          2m
my-kafka-cluster-zookeeper-0            1/1     Running   0          2m
my-kafka-cluster-zookeeper-1            1/1     Running   0          2m
my-kafka-cluster-zookeeper-2            1/1     Running   0          2m
strimzi-cluster-operator-...            1/1     Running   0          3m
```

## 6. Testing Kafka

You can create a Kafka topic and produce/consume messages:

```bash
# Create a topic

kubectl exec -it my-kafka-cluster-kafka-0 -n kafka -- \
  bin/kafka-topics.sh --create --topic test-topic --partitions 1 --replication-factor 1 --bootstrap-server my-kafka-cluster-kafka-bootstrap:9092

# Produce messages
kubectl exec -it my-kafka-cluster-kafka-0 -n kafka -- \
  bin/kafka-console-producer.sh --topic test-topic --bootstrap-server my-kafka-cluster-kafka-bootstrap:9092

# Consume messages
kubectl exec -it my-kafka-cluster-kafka-1 -n kafka -- \
  bin/kafka-console-consumer.sh --topic test-topic --from-beginning --bootstrap-server my-kafka-cluster-kafka-bootstrap:9092

Type a few messages in the producer terminal, and they should appear in the consumer terminal.
```

## 7. Clean Up

When you’re done, remove the cluster:

```bash
kind delete cluster --name kafka-demo
```

## Conclusion

With this setup, you have a quick local environment for developing or testing Kafka. The Strimzi operator abstracts away the complexity of Kafka management on Kubernetes. If you want to scale to a production environment, you’ll switch from ephemeral storage to persistent volumes, integrate with your cloud platform, and further tune your Terraform and Strimzi configs.


A step-by-step guide to setting up a Kafka cluster on a local Kind cluster using the Strimzi operator, with optional Terraform provisioning.

Posts tagged with: k8s