Description

Ensure production Managed Kubernetes clusters are created with their nodes attached to a private network (vRack), so that traffic between nodes and other private services, such as databases, stays off the public internet.

Rationale

When nodes use only public networking, traffic between the cluster and other services must cross the internet and the nodes are directly reachable from outside. A private network keeps internal traffic isolated and allows private connections to databases and other services.

Impact

  • Cluster traffic to private services stays isolated

  • Reduces public exposure of nodes

  • The private network can only be chosen when the cluster is created

Default Value

By default, clusters use public networking unless a private network is selected at creation. After a cluster is created, its region and private network cannot be changed.

Pre-Requisites

  • Permission to manage Kubernetes clusters

  • A vRack and a private network with a subnet in the cluster's region

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.

  4. On the cluster's Service tab, check whether a private network is attached.

  5. If no private network is attached, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. Create a new Managed Kubernetes cluster and, in the network step, select the private network (and Gateway if needed).

  4. Migrate the workloads to the new cluster.

  5. Delete the old cluster once the migration is confirmed.

Backout Plan

  1. Keep the original cluster running until the new one is confirmed, and switch workloads back if needed.

Reference