Hardening access to kubectl

DevOps Kubernetes
#1

Hi all, could you recommend some solution for hardening access to kubectl (k8s API)? I am trying to configure Cloudflare Zero Trust tunnel and it is not the easiest path to take. I mean something VPN-like…Thanks!

#2

Maybe firewall with whitelist will do?

#3

And you could have some ssh access to remote server somewhere, which ip will be whitelisted.

#4

You mean connecting through bastion host?

#5

There you will have more control

#6

And have audit history logs

#7

Port-forwarding can be configured to GUI uses

#8

And i can suggest another security method

#9

It is old, but still good, it is called port-knocking

#10

You can check this https://kilo.squat.ai/docs/kgctl

#11

Should be working on top of WireGuard vpn

#12

But i can be wrong, you need to research it yourself

#13

Scaleway provider is using kilo as a base in their Kubernetes Kosmos product.