Hacker News Reader

Well done. From the control plane section:

>The Kubernetes API server runs on port 6443, which should be protected by a firewall to accept only expected traffic.

How are folks doing this in practice at scale? Managing ACLs for kubectl, admins, workflow systems, distributed worker nodes etc?

View on HN

For a bare-metal cluster one simple set and forget about it solution is to port forward another external port (e.g., randomish 51203) to the internal control-plane-ip:6443 and block port scan attacks using fail2ban, DenyHosts, psad, etc. This should prevent most of the attacks.

There's actually quite a lot.

meaning lots of ACLs on both sides of the api server, or meaning lots of better (simpler, more secure) ways to do it?

Reply on news.ycombinator.com