security - GCP 库伯内斯 : Ingress and external load balancer with IAP lots of open ports scanning nmap

Question

我有一个 k8s 集群在带有外部 HTTPS 负载均衡器的 Ingress 后面运行一个服务，我有身份感知代理保护我的系统。入口有一个公共(public) IP，当我用 nmap 扫描它时，我看到以下开放端口:

PORT      STATE SERVICE
43/tcp    open  whois
53/tcp    open  domain
80/tcp    open  http
83/tcp    open  mit-ml-dev
84/tcp    open  ctf
85/tcp    open  mit-ml-dev
89/tcp    open  su-mit-tg
110/tcp   open  pop3
143/tcp   open  imap
443/tcp   open  https
465/tcp   open  smtps
587/tcp   open  submission
700/tcp   open  epp
993/tcp   open  imaps
995/tcp   open  pop3s
1084/tcp  open  ansoft-lm-2
1085/tcp  open  webobjects
1089/tcp  open  ff-annunc
1443/tcp  open  ies-lm
1935/tcp  open  rtmp
3389/tcp  open  ms-wbt-server
5222/tcp  open  xmpp-client
5432/tcp  open  postgresql
5900/tcp  open  vnc
5901/tcp  open  vnc-1
5999/tcp  open  ncd-conf
8080/tcp  open  http-proxy
8081/tcp  open  blackice-icecap
8085/tcp  open  unknown
8086/tcp  open  d-s-n
8088/tcp  open  radan-http
8089/tcp  open  unknown
8090/tcp  open  opsmessaging
8099/tcp  open  unknown
9100/tcp  open  jetdirect
9200/tcp  open  wap-wsp
20000/tcp open  dnp
30000/tcp open  ndmps

我的问题是为什么所有这些端口都打开，它是否从 IAP 打开，如果是，这就是为什么我能够在没有身份验证的情况下扫描似乎是 Ingress IP 的内容，并且最终我可以关闭除 HTTP 之外的所有端口/S 安全端口？如果是 IAP，也许这些需要打开以转发可能可用但不在我的集群中的不同服务的不同流量；这能解释这个吗？

任何提示都会很好，我已经 RTFMed 并且关于 Ingress 的一切似乎都指向它只接受 HTTP/S 流量并转发到服务/部署。这个 IAP 是让这些端口保持打开状态还是真的在 Ingress 上？它是与 Ingress 关联的 IP 地址。我是否需要向我的集群添加 FrontendConfig 来配置 Ingress 以关闭这些端口？

提前致谢!

Answer 1

我收到了 Google Cloud Platform 出色的支持团队的回复。谢谢谷歌!他们证实了我的假设，即这些端口对各种潜在服务开放，但我们的配置只允许我们向后端请求的内容。将此留在 stackoverflow 中，以防其他人需要此信息。

Clients communicate with a Google Front End (GFE) using yourKubernetes Load Balancer's external IP address and the GFEcommunicates with your backend services using the internal IP address.The GFE is actually forwarding the traffic to the backend instances[1]. Each GFE is actually serving content as a proxy and is not partof your configuration [2].

Each GFE serves traffic for many customers as part of its overallsecurity design [3] and the external IP address for your Kubernetesload balances is programmed on a number of shared GFE serversworldwide. Because the GFE is not unique to your or your loadbalancer's configuration, it also accepts traffic on other TCP ports.However, incoming traffic to the GFE on other ports is NOT sent toyour backends. This way, the GFE secures your instances by only actingon requests to ports you've configured - even if it's listening tomore.

For that reason, you see more ports open than expected.

You can read more about this behavior here [4].