Installer: Azure or AWS needs a way to avoid public IP exposure to the internet

[AndyFol]

Version

$ openshift-install version 

./openshift-install unreleased-master-1237-g22064445fd8a49824d77230b397cd49c2509c715
built from commit 22064445fd8a49824d77230b397cd49c2509c715
release image registry.svc.ci.openshift.org/origin/release:4.2

Platform:

What happened?

When building an IPI, we have a requirement to use access from a private entry point. This would be something like a transient gateway. However, IPI uses the creation of public IP addresses and Loadabalances and DNS that are assigned to them. The ask here is to have a private (non-publicly exposed) DNS zone or subdomain, that would be reachable within the VNET and the access should happen through the routing of a transient gateway. A bastion host can be created with 2 Nics that can access the entire infrastructure from the internet (if necessary) or preferably a VPN. This should allow the cluster to access the internet for red hat images but access into the cluster should be restricted.

What you expected to happen?

I would expect the definition of private or public access to the cluster in the installer or the ability to limit public IP access with NSG.

How to reproduce it (as minimally and precisely as possible)?

• compile and run the IPI on Azure.

References

• An IPI light or the ability to provision privacy in Azure and AWS clusters https://github.com/openshift/installer/issues/1083#issuecomment-504425397

[JuozasA]

Kubernetes Azure-loadbalancer reconciles the Network Security Group and the LB:
https://github.com/kubernetes/kubernetes/blob/fc32d2f3698e36b93322a3465f63a14e9f0eaead/pkg/cloudprovider/providers/azure/azure_loadbalancer.go#L806

Our cluster-ingress-operator uses Service type LoadBalancerService if nothing is provided:
https://github.com/openshift/cluster-ingress-operator/blob/5b423d4a09feb17320da12e3922b7528bb531970/manifests/00-custom-resource-definition.yaml#L433

So I think the issue here, we need to have a ability to change that service type on cr which is being created during OCP installation...

Thoughts?

[abhinavdahiya]

this is duplicate of https://github.com/openshift/installer/issues/1766

/close

[openshift-ci-robot]

@abhinavdahiya: Closing this issue.

In response to this:

this is duplicate of https://github.com/openshift/installer/issues/1766

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jeffspahr]

I don't see this as a duplicate of https://github.com/openshift/installer/issues/1766.

1766 wants to be able to use a proxy for its path out to the internet.

This ticket assumes the nodes can access the internet via a NAT Gateway, but it doesn't expose any pieces of the cluster publicly. All components get deployed in the private subnets of the VPC.