Public IP's and spread nodes about different locations

[godmaster35]

Hi vitobotta, everyone,

I was start using the script to get my first k3s experience since 4 months ago. It was just fun to get that fast to a working cluster. And for now it was running stable and our first migrated apps are quite ready to go into production. So thanks for sharing this awesome stuff.
Still there a questions I couldn't get an answer yet or maybe i just not found it ;-)

• using the script with 2 worker and 3 master nodes it generates public ip's for all machines (5). I have an ingress lb that routes external requests to the desired service. So my question is do i need a public ip on each machine. I could imagine that for security concerns this is not what others would recommend. What would i have to change in the cluster config script?
• second is how would I modify the cluster config script to spread master and worker nodes about different locations eg. fsn and nbg.

appreciate if someone could help or point me in the right direction

[vitobotta]

Hi @godmaster35,

first question: there are already the settings enable_public_net_ipv4 and enable_public_net_ipv6 that you can toggle to disable the public interfaces but it requires some extra setup, see #252. Also I haven't tested removing the public IPs from existing nodes but try asking in that discussion if others have. In terms of security, the tool configures a firewall to restrict access to SSH from known networks. The same applies to the Kubernetes API if there's only a master; with multiple master of course we need a load balancer, but unfortunately Hetzner doesn't support firewalls with the load balancers yet. I am thinking to address this by adding a setting that disables the creation of a load balancer for a cluster with multiple masters, and making it possible to fetch a kubeconfig from each master so you can still interact with other masters if one goes down. With either this change or if Hetzner adds support for load balancers to the firewalls, disabling public IPs will be more of a way to save some euros than a way to improve security. With Hetzner's firewalls traffic is restricted before even reaching the nodes, so even if they have a public IP there still is a very good protection for them. Personally, for my clusters at the moment I restrict access to SSH at least, and keep the load balancer for the K8s API until I make the change I mentioned above. Disabling public IPs requires some extra setup that I haven't wanted to implement yet for my clusters.

second question: at the moment you can spread worker nodes across different locations by just creating multiple node pools in different locations. For the masters it's on the roadmap. Also worth noting is that the tool uses "placement groups" for the servers, to ensure that all the servers in a pool go to different physical hosts. This is also useful to increase availability even within the same zone.

[godmaster35]

Hello Vitobotta, thank you very much for the detailed response - that helps me further. The mentioned restriction of SSH access - is this something i can add in the cluster-config.yml or do I have to configure it manually when the nodes are up?

[vitobotta]

See the README. It's the ssh_allowed_networks setting