ovn-kubernetes icon indicating copy to clipboard operation
ovn-kubernetes copied to clipboard

Support nodeport-addresses (NodePort IP ranges)

Open roytman opened this issue 4 years ago • 1 comments

From Kubernetes Support specifying NodePort IP range proposal:

By default, kube-proxy accepts everything from NodePort without any filter. It can be a problem for nodes which has both public and private NICs, and people only want to provide a service in private network and avoid exposing any internal service on the public IPs.

In order to resolve this issue, Kubernetes v1.10 added the --nodeport-addresses kube-proxy flag.

This flag takes a comma-delimited list of IP blocks (e.g. 10.0.0.0/8, 192.0.2.0/25) to specify IP address ranges that kube-proxy should consider as local to this node. For example, if you start kube-proxy with the --nodeport-addresses=127.0.0.0/8 flag, kube-proxy only selects the loopback interface for NodePort Services. The default for --nodeport-addresses is an empty list. This means that kube-proxy should consider all available network interfaces for NodePort."

I did not find a similar ovn-kubernetes feature, therefore I suggest to add it, at least in order to be compatible with kube-proxy.

roytman avatar Oct 26 '20 18:10 roytman