giantswarm/aws-operator

Use separate security group for the API ELB

nhlfr opened this issue · 4 comments

nhlfr commented

Currently the API ELB is in the masters security group. Moving it to a separate security group means only the API ELB needs to be 0.0.0.0/0

This is part of the security changes but can be implemented before we restrict the port access.

xh3b4sd commented

@rossf7 can you shed some light on this? Is this still valid?

rossf7 commented

Yes, I think we still need this. This means only the API ELB needs to be 0.0.0.0/0 and we restrict the master node to connections from the ELB and workers sec groups.

Ping @teemow is this part of guest cluster lockdown?

xh3b4sd commented

Then lets close this one here.