-
Notifications
You must be signed in to change notification settings - Fork 6.8k
Open
Labels
kind/featureCategorizes issue or PR as related to a new feature.Categorizes issue or PR as related to a new feature.
Description
What would you like to be added
Add a variable to configure the bind address of the internal NGINX load balancer health endpoint. By default, it should bind to 127.0.0.1 instead of 0.0.0.0.
The manifest is generated from the template:
nginx-proxy.manifest.j2
Why is this needed
When loadbalancer_apiserver_localhost: true, the internal NGINX load balancer runs on worker nodes with hostNetwork: true and listens on 0.0.0.0:8081, exposing an internal-only health endpoint on all interfaces.
Making the bind address configurable will:
- Reduce unnecessary exposure on worker nodes
- Align with security hardening and CIS benchmarks
- Avoid pentest noise for internal-only endpoints
Metadata
Metadata
Assignees
Labels
kind/featureCategorizes issue or PR as related to a new feature.Categorizes issue or PR as related to a new feature.