We have a Kubernetes cluster (kube-)sprayed over 4 nodes running CoreOS. Our most important services will run in this Kubernetes environment and we are trying to do everything we can to make it as secure as possible, however we plant to expose the API port (6443) to the internet.
Is that considered safe to do?
We did the following so far:
We disabled anonymous access (with the --anonymous-auth=false flag).
Certificate checking seems to work fine, without providing client-certificate-data, I can't access anything on the cluster.
We are planning to use RBAC authorization.
We currently have the latest version of kubernetes installed (and we plan to update quickly as new fixes release).
We have a firewall with rate-limiting set up to mitigate brute force attacks.
The switch we bought for the server support DDoS protection.
Are there any further steps we could take to make that exposed port secure? Or is it completely ill-advised to do so?