Description

Ensure the Kubernetes API server of every OVHcloud Managed Kubernetes cluster accepts connections only from approved IP ranges, such as office networks, VPNs, or CI/CD runners, by configuring APIServer access restrictions.

Rationale

The Kubernetes API server controls the whole cluster. If it is open to the internet, anyone can try to authenticate, exploit vulnerabilities, or use a leaked kubeconfig from anywhere. Restricting access to known IP ranges adds a strong network barrier in front of the cluster.

Impact

  • Only approved networks can reach the API server

  • Leaked kubeconfig files cannot be used from unknown networks

  • New CI runners or offices must be added to the list

Default Value

By default, the API server accepts connections from any IP address.

Pre-Requisites

  • Permission to manage the Kubernetes cluster

  • A list of IPv4 ranges that need API server access

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  4. Open the APIServer access tab.

  5. Verify that at least one IP restriction is listed and that it does not allow all addresses (0.0.0.0/0).

  6. If there are no restrictions, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  4. Open the APIServer access tab (or click Modify limitations).

  5. Click + Add a new limitation, enter an IPv4 range in the IP/CIDR range field and an optional description, and click the ✔ button.

  6. Add each approved range, then confirm that kubectl still works from those networks.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  4. Open the APIServer access tab and delete the IP restrictions to allow all addresses again.

Reference