Skip to content

Make internal NGINX load balancer bind address configurable #12809

@hadi2f244

Description

@hadi2f244

What would you like to be added

Add a variable to configure the bind address of the internal NGINX load balancer health endpoint. By default, it should bind to 127.0.0.1 instead of 0.0.0.0.

The manifest is generated from the template:
nginx-proxy.manifest.j2

Why is this needed

When loadbalancer_apiserver_localhost: true, the internal NGINX load balancer runs on worker nodes with hostNetwork: true and listens on 0.0.0.0:8081, exposing an internal-only health endpoint on all interfaces.

Making the bind address configurable will:

  • Reduce unnecessary exposure on worker nodes
  • Align with security hardening and CIS benchmarks
  • Avoid pentest noise for internal-only endpoints

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/featureCategorizes issue or PR as related to a new feature.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions