This question is regarding firewall rule on GCP.

I run my development and production server on the same cluster and separating them by namespace only. For development, I expose a nodeport (e.g. 8000) and create a GCP firewall rule to access the development server.

Is this dangerous? Since the firewall rule would allow access all pods at port 8000 on the cluster.

  • 1
    Can you expose different ports for development and production, instead? – Michael Hampton Oct 6 '18 at 12:36
  • Production uses different port. – gke Oct 7 '18 at 13:21
  • Limit port access to specific CIDR block addresses. You can create one rule for your home public IP, another for the office public IP, etc. This will prevent public access to your nodeport. – John Hanley Oct 7 '18 at 18:10

Firewall is only limited to your nodes only and the range is as follows 30000–32767. As @John Hanley mentioned limit port access to specific CIDR block addresses. So using port 30000 as an example opens a specific port on all the Nodes (the VMs), and any traffic that is sent to this port is forwarded to a service, which only serves a subset of pods, not all pods.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.