You Can't Use GKE External Name Service with Private Zone Cloud DNS

CNAME Chasing is the root issue

In one of my projects, there was a requirement to be able to route between a GKE backend and a GCS backend. Since life was easier if the External Load Balancer was just created with GKE’s Ingress resource, we decided to try splitting the traffic to GCS using an External Name service.

The Problem

Somehow the backend service for the External Name was not working.

I went into the cluster and attempted to do curl . It failed to resolve the host. Then, I tried dig and confirmed that the CNAME was being returned.

It took me a while to find out that CNAME chasing is not possible for Cloud DNS in private zones.

The infrastructure design was bad already, so I decided to go with a standalone External LB + standalone NEG setup. It’s unfortunate that we now have to manage the infrastructures separately with terraform and kuberenetes though.