Turn on the firewall for a Vultr Kubernetes Engine cluster, then add a firewall group and rules to limit traffic.
The Vultr Kubernetes Engine (VKE) cluster firewall controls inbound network traffic to the worker nodes in your cluster. When you enable it, VKE creates a dedicated firewall group named VKE-Firewall- followed by the cluster ID and attaches every worker node to it. The firewall group accepts all incoming traffic until you add at least one rule, so add rules that allow only the connections your applications need.
Follow this guide to enable the firewall for a Vultr Kubernetes Engine cluster and add firewall rules using the Vultr Console, API, CLI, or Terraform. The Vultr API and CLI can enable the firewall only when you create the cluster.
Navigate to Compute and click Kubernetes.
Click the target cluster to open its management page.
Click the Firewall tab.
If the firewall is not enabled, click Enable Firewall to deploy a managed firewall group for the cluster. While the firewall is enabled, VKE links all nodes to the managed firewall group, moves nodes linked to another firewall group to the managed one, and attaches Load Balancer services to the cluster's VPC network. Load Balancer services can experience brief downtime while they attach to the VPC network.
The firewall group accepts all incoming traffic until you add at least one rule.
Click the firewall group link to open the cluster's firewall group page.
Verify that the Name field in the Basics section shows VKE-Firewall- followed by the cluster ID, and that Attached Instances matches the number of worker nodes in the cluster.
Click Add Rule in the Inbound IPv4 Rules section. To add an IPv6 rule, click Add Rule in the Inbound IPv6 Rules section instead.
In the Add IPv4 Rule panel, click the Protocol drop-down and select a protocol, such as SSH, HTTP, HTTPS, TCP, UDP, or ICMP.
Enter a port or port range in the Port / Range field. Predefined protocols, such as HTTP, fill in the port automatically.
Click the Source drop-down and select the traffic source, such as Cloudflare or a custom IP address range.
Optionally, enter a description for the rule in the Note (optional) field.
Click Add Rule + to add the rule to the firewall group.
0 Comments
Be the first to comment and share your perspective with the community.