# Ensure Kubernetes API Server Access Is IP-Restricted

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826029818466-ensure-kubernetes-api-server-access-is-ip-restricted
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the Kubernetes API server of every OVHcloud Managed Kubernetes cluster accepts connections only from approved IP ranges, such as office networks, VPNs, or CI/CD runners, by configuring APIServer access restrictions.

**Rationale**

The Kubernetes API server controls the whole cluster. If it is open to the internet, anyone can try to authenticate, exploit vulnerabilities, or use a leaked kubeconfig from anywhere. Restricting access to known IP ranges adds a strong network barrier in front of the cluster.

**Impact**

-   Only approved networks can reach the API server
    
-   Leaked kubeconfig files cannot be used from unknown networks
    
-   New CI runners or offices must be added to the list
    

**Default Value**

By default, the API server accepts connections from any IP address.

**Pre-Requisites**

-   Permission to manage the Kubernetes cluster
    
-   A list of IPv4 ranges that need API server access
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
4.  Open the APIServer access tab.
    
5.  Verify that at least one IP restriction is listed and that it does not allow all addresses (0.0.0.0/0).
    
6.  If there are no restrictions, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
4.  Open the APIServer access tab (or click Modify limitations).
    
5.  Click + Add a new limitation, enter an IPv4 range in the IP/CIDR range field and an optional description, and click the ✔ button.
    
6.  Add each approved range, then confirm that kubectl still works from those networks.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
4.  Open the APIServer access tab and delete the IP restrictions to allow all addresses again.
    

**Reference**

-   [https://help.ovhcloud.com/csm/en-public-cloud-kubernetes-add-ip-restrictions?id=kb\_article\_view&sysparm\_article=KB0049588](https://help.ovhcloud.com/csm/en-public-cloud-kubernetes-add-ip-restrictions?id=kb_article_view&sysparm_article=KB0049588)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.