We have a pod which acts as an SFTP server and needs to be exposed on port 22. It must be port 22 to give a seamless transition from our old infrastructure. This pod must be exposed externally, accessible from everything (ie
0.0.0.0/0). Port 22 is blocked on our GCP networks except for specific VMs for compliance, and this block covers our k8s nodes.
The three solutions we came up with, none of which we want to implement, were:
- Using the cluster as the target tag, expose the entire cluster (too risky/compliance)
- Limit the pod to one node, and expose only that node (no redundancy)
- Create a new node pool specifically for this service, and expose only that node pool (has redundancy but expensive)
Is there any way that I haven't listed above in which we can expose this pod/loadbalancer without exposing other parts of the network?