How to Use NodePort in Custom Kubenetes Cluster on GCP – Debian

For training purpose, I’m trying to setup my own cluster on GCP without using GKE.

I hafe successfully created a cluster with kubeadm with 2 nodes. I’m running an nginx app and exposed it with NodePort. All my pods and services are running.

kubectl get nodes -owide

NAME       STATUS   ROLES                  AGE     VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE                       KERNEL-VERSION   CONTAINER-RUNTIME
master-1   Ready    control-plane,master   4m43s   v1.20.0   10.132.0.2    <none>        Debian GNU/Linux 9 (stretch)   4.9.0-14-amd64   docker://19.3.14
worker-1   Ready    <none>                 3m9s    v1.20.0   10.132.0.3    <none>        Debian GNU/Linux 9 (stretch)   4.9.0-14-amd64   docker://19.3.14

kubectl get svc -owide

kubernetes   ClusterIP   10.96.0.1       <none>        443/TCP        37m   <none>
nginx        NodePort    10.102.241.17   <none>        80:30695/TCP   31m   app=nginx

Here is my google_compute_instance terrafom

resource "google_compute_instance" "default" {
    name = var.vm_name
    machine_type = "e2-standard-2"
    zone = "europe-west1-b"

    boot_disk {
        initialize_params {
            image = "debian-cloud/debian-9"
        }
    }

    network_interface {
        network = var.network
        access_config {
            // Include this section to give the VM an external IP address
        }
    }

    metadata_startup_script = file("./scripts/bootstrap.sh")

    tags = ["node"]
}

Here is my terrafom firewall:

resource "google_compute_network" "vpc_network" {
  name = "k8s-node"
}

resource "google_compute_firewall" "default" {
  name    = "k8s-firewall"
  network = google_compute_network.vpc_network.name

  allow {
    protocol = "icmp"
  }

  allow {
    protocol = "tcp"
    ports    = ["80", "6443", "30000-32767"]
  }

  source_tags = ["node"]
  source_ranges = ["0.0.0.0/0"]
}

With this config, I can not access my instance with http://my-instance-ip:30695 … I have a timeout.

But it’s working when I allow all Protocols and ports in my GCP console for my firewall rules k8s-firewall.
With all protocol and port allowed, I can access my app properly with http://my-instance-ip:30695…

What is the issue with my firewall? For me it’s suppose to work when I allow only a range between 30000 and 32767 as k8s uses this range for NodePort services.