Hello! I want to restrict access to kubernetes nodes from certain tags, for example - droplets with different tags being on the same subnet. In case of applying such a firewall to a droplet there is no problem, but in my case - when creating kubernetes, cloud automatically creates its firewall, which cannot be changed (https://docs.digitalocean.com/products/kubernetes/details/managed/#worker-node-firewalls). I can create my own firewall, but it only allows opening new rules, but not closing. How can I restrict access to kubernetes worker node from certain tags?
Example: I want both kubernetes clusters to be accessible from one droplet and only one kubernetes cluster to be accessible from the other droplet. Droplets should have full internet access
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Hey Sergei,
Based on what I’ve seen and what’s in the docs, the default worker node firewalls are fully managed by DigitalOcean and can’t be modified directly, any changes get reverted automatically.
You can attach your own Cloud Firewall to the worker nodes (using tags), but it only works for opening additional ports, it won’t let you block access that’s already allowed by the default rules. That makes it tricky if you’re trying to restrict traffic between certain Droplets and specific clusters.
There is an annotation you can use though: kubernetes.digitalocean.com/firewall-managed: "false", this disables automatic public access to NodePorts for a given service, which might help if you’re trying to keep certain services internal-only.
Not 100% sure if that helps in your exact case, especially across multiple clusters, but might be worth testing. And I’d still recommend checking with support to see if there’s a newer workaround, DigitalOcean has been adding more advanced networking stuff lately:
- Bobby
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.