Kops: Exposing additional ports on bastion host.

[thereallukl]

I would like to setup OpenVPN server on the bastion host to securely access my network with private topology, unfortunately it seems that only port 22 is allowed (although with custom CIDR subnets).

Is it possible to add custom security groups to ELB and instance to support any TCP/UDP traffic?

[krogon-dp]

Did you tried with additionalSecurityGroups for InstanceGroupSpec ?
https://github.com/kubernetes/kops/blob/4e284e9966298b082d7b1b1468b83b14ccd4d541/pkg/apis/kops/v1alpha2/instancegroup.go#L90

[chrislovecnm]

Can we close this?

[thereallukl]

Unfortunately additionalSecurityGroups is attaching SG to instance instead of bastion's LB. I can simply bypass LB and connect directly to bastion, but in this case what's the point of LB in front of it?

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.