Question

How to set a IP restriction on NodePort range of DO managed Kubernetes?

Hi there.

Weeks ago, I already asked a question for how to customize DO managed Kubernetes firewall on forum.

I know how to ADD new firewall rules now, but I don’t know how to customize EXISTING RULES which already added by default DO Kubernetes.

For example, DO defaultly marked that Kubernetes NodePort range (30000 ~ 32767) as a public access, which allows every IPs without any restrictions.

But I want to ONLY ALLOW my own IP to reach NodePort in this case.

Already tried to make an additional firewall with IP restriction on NodePort range, and bound it with my DOKS cluster, But didn’t work properly.

Any helpful tips for this?

Thanks.


Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.

With 1.19 this is finally possible! NodePort range is now closed by default. NodePort Services will open the automatic firewall. This can be disabled via annotation, for example:

apiVersion: v1
kind: Service
metadata:
  name: traefik
  namespace: default
  annotations:
    kubernetes.digitalocean.com/firewall-managed: "false"
spec:
  type: NodePort
  ports:
    - protocol: TCP
      name: web
      port: 8000
      nodePort: 30000
  selector:
    app: traefik

Now using an additional custom firewall applied to the cluster, NodePort service connectivity can be properly limited.

Hi there,

Unfortunately, it is not currently possible to add further restrictions to this nodeport range. Because our cloud firewalls are whitelist based, a DENY cannot override an ALLOW. We are currently exploring ways to make the DOKS generated objects more flexible to accommodate a wider range of customer use cases.

Modifying the generated cloud firewall is also not recommended and although it will work temporarily, it will be overwritten by the cluster reconciler to the default settings.

The cloud resources(volumes/Load Balancers/Firewall) created by DOKS are not intended to be manually modified/renamed. This is because the DOKS reconciler looks to find cloud resources with the name they were created with in order to manage and validate its settings. If there are manual modifications made to a cloud resource’s settings, the reconciler will overwrite them.

A workaround to what your trying to do would be to expose an ingress-controller service to front your other services. Then you may use the whitelist annotation functionality, for example, provided by the nginx ingress controller. See the documentation here:

https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md#whitelist-source-range

Regards,

John Kwiatkoski Senior Developer Support Engineer