Q: Your production GKE clusters and Cloud SQL databases have public endpoints completely disabled for security compliance. Standard Cloud Build cannot reach internal RFC 1918 IP addresses to deploy applications or run schema migrations. How do you design and deploy Cloud Build Private Pools inside your VPC?
Runbook for replacing default public Cloud Build workers with Private Worker Pools peering into private VPC networks, enabling secure access to private GKE clusters, Cloud SQL, and internal artifact registries.
#GCP #Cloud Build #Private Pools #VPC-SC #Security #DevOps
🎙️ Candidate Opening & Architectural Context
"When our organization locked down all internal infrastructure behind private VPC endpoints, our CI/CD pipelines stalled because standard Google-managed Cloud Build runners execute in a shared public multi-tenant network with no access to private subnets."
Advertisement
⚡ Recommended Practice Lab
Want to master this scenario in a live sandbox? Stephane Maarek's AWS Certified DevOps Engineer Professional Masterclass on Udemy covers this exact problem with hands-on terminal drills.
🛠️ Production Runbook & Step-by-Step Resolution
1️⃣
Establish Service Networking Private Connection for Cloud Build
Allocate a dedicated CIDR block in your VPC for private Google service producer peering:
- IP Range Reservation: Allocated private range:
gcloud compute addresses create cloud-build-pool-range --global --purpose=VPC_PEERING --prefix-length=24 --network=prod-vpc. - Peering Connection: Created peering with Google Services:
gcloud services vpc-peerings connect --service=servicenetworking.googleapis.com --ranges=cloud-build-pool-range --network=prod-vpc.
Pro Tip: The /24 CIDR range allows Google to spin up dynamic VM workers inside Google-managed infrastructure while routing directly to your private VPC.
2️⃣
Provision Cloud Build Private Worker Pool
Deploy dedicated, single-tenant build workers with customizable machine specifications:
- Create Worker Pool: Executed
gcloud builds worker-pools create private-pool-us --region=us-central1 --peered-network=projects/PROJ_ID/global/networks/prod-vpc --worker-machine-type=e2-standard-4 --worker-disk-size=100GB --no-public-egress. - No Public Egress: Set
--no-public-egressto prevent build jobs from accessing the public internet directly, routing outbound traffic strictly through corporate Cloud NAT and firewalls.
Pro Tip: Disabling public egress guarantees that build runners cannot inadvertently exfiltrate proprietary source code or credentials to external servers.
3️⃣
Configure Internal VPC Firewall Rules & Private GKE Master Access
Grant private worker CIDR blocks access to internal cluster control planes and internal databases:
- GKE Authorized Networks: Added Cloud Build CIDR (e.g.,
10.250.0.0/24) to GKE private cluster master authorized networks. - VPC Firewall Rule: Created ingress firewall rule on target GKE and Cloud SQL instances permitting TCP ports 443, 5432 from the Cloud Build private subnet.
Pro Tip: Without adding the worker pool CIDR to GKE Master Authorized Networks, kubectl commands running in the private pool will encounter connection timeouts.
4️⃣
Execute Cloud Build Workflows on Private Worker Pool
Update cloudbuild.yaml definitions to run steps inside the private worker pool:
- YAML Pool Specification: Added
options: { pool: { name: 'projects/PROJ_ID/locations/us-central1/workerPools/private-pool-us' } }. - Validation Build: Executed build verifying seamless execution of
kubectl applyagainst private GKE control plane andflyway migrateagainst private Cloud SQL.
Pro Tip: Cloud Build private worker pools combine the autoscaling ergonomics of serverless CI with the network isolation of private enterprise data centers.
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Cloud Build Private Worker Pools peer Google-managed compute runners directly into your VPC, enabling zero-trust CI/CD access to private GKE clusters and databases without exposing public endpoints."
⚡ 60-Second Elevator Pitch Talking Points
- Allocate a dedicated RFC 1918 CIDR block and configure VPC Service Networking peering.
- Create a Cloud Build Private Worker Pool with --no-public-egress for strict data loss prevention.
- Authorize the private worker pool CIDR in GKE master authorized networks and firewall rules.
- Specify the pool resource path in cloudbuild.yaml to execute fully isolated enterprise builds.
Advertisement