mirror of https://github.com/kubernetes/kops.git
63 lines
2.2 KiB
Markdown
63 lines
2.2 KiB
Markdown
# Bastion in Kops
|
|
|
|
Bastion provide an external facing point of entry into a network containing private network instances. This host can provide a single point of fortification or audit and can be started and stopped to enable or disable inbound SSH communication from the Internet, some call bastion as the "jump server".
|
|
|
|
Note: Bastion will get setup for the cluster(by default) only when `--topology="private"`.
|
|
|
|
* [More information on bastion from aws](http://docs.aws.amazon.com/quickstart/latest/linux-bastion/architecture.html)
|
|
* [More information on bastion from gce](https://cloud.google.com/solutions/connecting-securely#bastion)
|
|
|
|
## AWS
|
|
|
|
### Specify instance type of bastion
|
|
|
|
Instance types in AWS comprise varying combinations of CPU, memory, storage, and networking capacity and give you the flexibility to choose the appropriate mix of resources for your applications.
|
|
|
|
- **Defaults** to `t2.medium`
|
|
- **Configure:** Bastion Instance type can be modified using `kops edit cluster`
|
|
```
|
|
topology:
|
|
bastion:
|
|
MachineType: c4.large
|
|
```
|
|
[More information](https://aws.amazon.com/ec2/instance-types/)
|
|
|
|
|
|
### Turn on/off bastion
|
|
|
|
To turn on/off bastion host setup completely.
|
|
- **Defaults** to `false` if the topology selected is `public`
|
|
- **Defaults** to `true` if the topology selected is `private`
|
|
- **Configure:**
|
|
```
|
|
kops create cluster --bastion=[true|false]
|
|
```
|
|
OR using `kops edit cluster`
|
|
```
|
|
topology:
|
|
bastion:
|
|
Enable: true
|
|
```
|
|
|
|
### Reach bastion from outside of vpc using a name
|
|
|
|
- **Default:** CNAME for the bastion is only created when the user explicitly define it using `kops edit cluster`
|
|
- **Configure:** Bastion friendly CNAME can be configured using `kops edit cluster`
|
|
```
|
|
topology:
|
|
bastion:
|
|
PublicName: jumper
|
|
```
|
|
|
|
### High idle timeout for bastion ASG's ELB. (Configurable LoadBalancer Attributes)
|
|
|
|
By default, elastic load balancing sets the idle timeout to `60` seconds.
|
|
- **Default:** Bastion ELB in kops will have `120` seconds as their default timeout.
|
|
- **Configure:** This value can be configured using `kops edit cluster`
|
|
```
|
|
topology:
|
|
bastion:
|
|
IdleTimeOut: 75
|
|
```
|
|
[More information](http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-idle-timeout.html)
|