3 ms·
Well done. From the control plane section: >The Kubernetes API server runs on port 6443, which should be protected by a firewall to accept only expected traff
by gz5 4y ago
Well done. From the control plane section:
>The Kubernetes API server runs on port 6443,
which should be protected by a firewall to accept only
expected traffic.
How are folks doing this in practice at scale? Managing ACLs for kubectl, admins, workflow systems, distributed worker nodes etc?
- PubliusMI 4y agoThere's actually quite a lot.
- gz5 4y agomeaning lots of ACLs on both sides of the api server, or meaning lots of better (simpler, more secure) ways to do it?
- ly3xqhl8g9 4y agoFor a bare-metal cluster one simple set and forget about it solution is to port forward another external port (e.g., randomish 51203) to the internal control-plane-ip:6443 and block port scan attacks using fail2ban, DenyHosts, psad, etc. This should prevent most of the attacks.