Question

NAT Gateway for Database Connections

Posted September 12, 2021 76 views
NetworkingKubernetesDatabases

We have a SQL server hosted on a cloud VPS and a kubernetes cluster hosted on here (Digital Ocean)

Our server the SQL sever sits on, has firewall rules to only allow whitelist IPs to connect to the SQL server. So currently we add the IPs to each of the kubernetes nodes so they can each connect the the SQL server.

This obviously isn’t scalable and is a challenge to maintain as any new node we have to add the IP to the firewall rule, etc…

In AWS we got round this by using a NAT gateway which allowed us to only need to whitelist the one IP.

Is there anything like that in Digital Ocean that we can use for database access of our nodes without whitelisting each’s IP, or are there any other alternatives to this issue on DO?

Thank you :)

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
Submit an Answer
1 answer

@tectosoftware First, have you tried using a K8s Ingress resource where one can map the external IP address to an internal service name? Then all the containers within your K8s can gain access to the DB via the internal service name.

Second, are you putting this external DB service behind K8s Service resource? For example,

kind: Service
apiVersion: v1
metadata:
  name: some-db-service
spec:
  type: ExternalName
  externalName: some-db-service–instance.123456789012.us-east-1.rds.amazonaws.com

Then all the containers within the K8s cluster can access the DB using some-db-service. I would typically perform this action first because it would allow one to push IPs to the boundary of the application.

I wish that this helps in some way and all the best with your project.

Think different and code well,

-Conrad

  • @conradwt Thank you for you reply.

    That database is held on a remove VPC and not in the kubnernetes cluster/digital ocean. So apologies if I misunderstand but an ingress will not help here as it relates to traffic coming into the cluster opposed to out of it

    we have services in our cluster that can be placed on any of the kubernetes nodes, and each of them need to access databases not on kubernetes/DO on a VPC

    • In your case, you’ll need both Ingress and Egress K8s resources if you’re reading and writing data here.

      If your services within the cluster need to gain access to an external DB, then you should be able to use either 1) K8s Ingress and Egress or (2) K8s Service ExternalName.

      • @conradwt Thank you again for your reply, but I don’t think you quite get the issue.

        The sql server only allows traffic in if it is part of its whitelist. This means for containers to be able to access that database (without getting blocked) each of the kubernetes cluster nodes need to have their IPs whitelisted with the SQL Server.

        So the problem is that, 1. this is a manual task which is not maintainable, 2. nodes can be added/removed/replaced meaning changes are need to the whitelist when this happens.

        In AWS or similar you can set up a NAT gateway which gives you all traffic running through that one static IP, so you can whitelist just that NAT gateway. However DO doesnt have this feature.

        I have been pointed to this post:
        https://www.digitalocean.com/community/questions/is-it-possible-to-have-a-static-outgoing-ip-in-kubernetes

        In which it seems my only option on DO is to us a proxy in front of the DB

        • Yes, this solution is workable if you’re not always changing your cluster. It’s unfortunate that this has become a long-standing issue here at DO.