We have a pod which acts as an SFTP server and needs to be exposed on port 22. It must be port 22 to give a seamless transition from our old infrastructure. This pod must be exposed externally, accessible from everything (ie Port 22 is blocked on our GCP networks except for specific VMs for compliance, and this block covers our k8s nodes.

The three solutions we came up with, none of which we want to implement, were:

  • Using the cluster as the target tag, expose the entire cluster (too risky/compliance)
  • Limit the pod to one node, and expose only that node (no redundancy)
  • Create a new node pool specifically for this service, and expose only that node pool (has redundancy but expensive)

Is there any way that I haven't listed above in which we can expose this pod/loadbalancer without exposing other parts of the network?


When you expose your pod, or deployment, you do so with a service. For your use case, you will want to use a service type LoadBalancer which will create an external endpoint (external IP) and a corresponding GCE Network Load Balancer. Traffic will then be forwarded from the Load Balancer to the Node Port (in the 30000 range) which will then have traffic forwarded to the target port, which in your case is port 22.

What this means is that the pod is exposing port 22 but the GKE node (GCE VM) is exposing port 30xxx. GKE will handle creating the appropriate firewall rule for you.

Additionally, if you are concerned with security, you can also filter traffic based on source ranges

  • I'm aware of having to use a LoadBalancer service. And as mentioned in OP, the source range must be, so limiting the source range won't be much help. Furthermore, the port as exposed to the internet needs to be 22. People need to connect on port 22. We can't hide or use a different port - using the node port as you're suggesting would do this. – G Newbury Nov 26 '18 at 11:09
  • You can use LoadBalancer to expose port 22, however, this won't actually expose port 22 on any nodes and thus won't cause a security risk. – Patrick W Nov 26 '18 at 14:47
  • Little late to the party but might help someone, what @GNewbury said is the best approach for your needs, the NodePort will be on 30000-32767 range but this is only how it works behind the scenes, by using a LoadBalancer service type you are exposing your pod port 22 only to the internet with pod redundancy (if implemented) and with no new node pool as you wanted. – Frank Mar 1 '20 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.