// Module included in the following assemblies:
//
// * installing/installing_gcp/installing-gcp-private.adoc

:_mod-docs-content-type: REFERENCE
[id="private-clusters-about-gcp_{context}"]
= Private clusters in {gcp-short}

[role="_abstract"]
To create a private cluster on {gcp-first}, you must provide an existing VPC network and subnets to host the cluster, and you must specify `publish: Internal` in your `install-config.yaml` file. The installation program must also be able to resolve the DNS records that the cluster requires. The installation program configures the Ingress Operator and API server for only internal traffic.

The cluster still requires access to internet to access the {gcp-short} APIs.

The following items are not required or created when you install a private cluster:

* Public subnets
* Public network load balancers, which support public ingress
* A public DNS zone that matches the `baseDomain` for the cluster

The installation program does use the `baseDomain` that you specify to create a private DNS zone and the required records for the cluster. The cluster is configured so that the Operators do not create public records for the cluster and all cluster machines are placed in the private subnets that you specify.

Because it is not possible to limit access to external load balancers based on source tags, the private cluster uses only internal load balancers to allow access to internal instances.

The internal load balancer relies on instance groups rather than the target pools that the network load balancers use. The installation program creates instance groups for each zone, even if there is no instance in that group.

* The cluster IP address is internal only.
* One forwarding rule manages both the Kubernetes API and machine config server ports.
* The backend service is comprised of each zone's instance group and, while it exists, the bootstrap instance group.
* The firewall uses a single rule that is based on only internal source ranges.

[id="private-clusters-limitations-gcp_{context}"]
== Limitations

No health check for the Machine config server, `/healthz`, runs because of a difference in load balancer functionality. Two internal load balancers cannot share a single IP address, but two network load balancers can share a single external IP address. Instead, the health of an instance is determined entirely by the `/readyz` check on port 6443.

////
Is this also valid in GCP?

The ability to add public functionality to a private cluster is limited.

* You cannot make the Kubernetes API endpoints public after installation without taking additional actions, including creating public subnets in the VPC for each availability zone in use, creating a public load balancer, and configuring the control plane security groups to allow traffic from the internet on 6443 (Kubernetes API port).
////
