NAT Gateway for Database Connections

We have a SQL server hosted on a cloud VPS and a kubernetes cluster hosted on here (Digital Ocean)

Our server the SQL sever sits on, has firewall rules to only allow whitelist IPs to connect to the SQL server. So currently we add the IPs to each of the kubernetes nodes so they can each connect the the SQL server.

This obviously isn’t scalable and is a challenge to maintain as any new node we have to add the IP to the firewall rule, etc…

In AWS we got round this by using a NAT gateway which allowed us to only need to whitelist the one IP.

Is there anything like that in Digital Ocean that we can use for database access of our nodes without whitelisting each’s IP, or are there any other alternatives to this issue on DO?

Thank you :)

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.

@tectosoftware First, have you tried using a K8s Ingress resource where one can map the external IP address to an internal service name? Then all the containers within your K8s can gain access to the DB via the internal service name.

Second, are you putting this external DB service behind K8s Service resource? For example,

kind: Service
apiVersion: v1
  name: some-db-service
  type: ExternalName
  externalName: some-db-service–

Then all the containers within the K8s cluster can access the DB using some-db-service. I would typically perform this action first because it would allow one to push IPs to the boundary of the application.

I wish that this helps in some way and all the best with your project.

Think different and code well,