API Server is a crucial component of Kubernetes that allows cluster configuration, workload management and a lot more. While this endpoint is incredibly important to secure; developers and engineers typically require regular and convenient access to that API. Striking a balance between security and convenience is quite desirable here.
Azure Kubernetes Service (AKS) provides two robust mechanisms to restrict access to the API Server: namely through restricting authorized source IP addresses or disabling public access to the API endpoint.
While the above two controls ensure additional security for the API endpoint, developers and engineers do face a few challenges here:
- With the rise of remote work, many users could be unable to keep a static source IP address that has been whitelisted by AKS.
- Although VPN solutions are increasingly deployed, many users could find that always on VPN becomes a challenge sometimes; especially if it affects an already low internet bandwidth at home.
- While some users get access to a jump box or an Azure Bastion host, it lacks many notable features like AD authentication or a true desktop experience.
Read the full article
