amazon-web-services - 将K8s POD暴露给单个/范围的外部IP

Question

我们想将POD公开给外部IP。如果我们使用AWS LB，那么它将对公众开放。有其他解决方案吗？

这是我到目前为止所做的:

{
  "kind": "Service",
  "apiVersion": "v1",
  "metadata": {
    "name": "testing"
  },
  "spec": {
    "ports": [{
      "port": 80,
      "targetPort": 8080
    }],
    "selector": {
      "app": "testing"
    },
    "type": "LoadBalancer"
  }
}

我们希望仅将其公开给单个IP或一系列外部IP。

Answer 1

您可以使用docs中记录的.spec.loadBalancerSourceRanges键:

This field takes a list of IP CIDR ranges, which Kubernetes will use to configure firewall exceptions. This feature is currently supported on Google Compute Engine, Google Kubernetes Engine, AWS Elastic Kubernetes Service, Azure Kubernetes Service, and IBM Cloud Kubernetes Service