Block externa-IP resolving in kubernetes

Question

I have a created an nginx pod and nginx clusterIP service and assign an externalIP to that service like below

NAME                   TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                            AGE
test-nginx             ClusterIP   10.110.93.251    192.168.0.10        443/TCP,80/TCP,8000/TCP,5443/TCP   79m

In one of my application pod, I am trying to execute below command and get the fqdn of it.

>>> import socket
>>> socket.getfqdn('192.168.0.10')
'test-nginx.test.svc.cluster.local'

It returns me the nginx service fqdn instead of my host machine fqdn. Is there a way to block dns resolution only for external-ip ? or is there any other workaround for this problem?

Answer 1

You assigned an external ip to a ClusterIP service in Kubernetes, so you can access your application from outside the Cluster, but you are concerned about the Pods having access to that external ip and want to block the dns resolution.

This is not the best approach to your issue, Kubernetes has several ways to expose the services without compromising the security; for what you want, maybe a better option is to implement an Ingress instead.

As you can see in the diagram, the Ingress routes the incoming traffic to the desired service based on configured rules, isolating the outside world from your service and only allowing specific traffic to go in. You can also implement features as TLS termination for your HTTPS traffic, and it performs load balancing by default.

Even further, if your main concern is security within your Cluster, you can take a look at the Istio Service mesh.