I have a Kubernetes cluster, and for reasons I won't go into here, I also have a VM instance (running a single Docker container) on the same network, providing a specific kind of ingress and forwarding that traffic to an internal LoadBalancer type of k8s service.
This is all working fine. Now I want to restrict the network access of this VM to not have access to anything except the IP of the internal LoadBalancer.
What are my options for achieving this?
create-with-container
instances run their Docker containers on the host network, so it shares that same network. The LB is a kubernetes service created with the the "LoadBalancer" type and "Internal" annotation.whitelist-source-range
is an option... but you will neet to change your service to ingress. Depending of what CNI you are running, you can try to use NetworkPolicies.