Configure access control for the cluster API server
Each ACS cluster includes a private Server Load Balancer (SLB) instance as the internal API server endpoint. Configure a whitelist or blacklist on the port 6443 listener to control access.
Background
SLB supports listener-level access control, configurable when you create a listener or at any time afterward.
For public-facing SLB instances, control listener access by adding public IP addresses.
Procedure
Set up a whitelist or blacklist for each listener to allow or block specific IP addresses.
-
Log on to the ACS console. In the left-side navigation pane, choose Clusters.
-
On the Clusters page, click the name of your target cluster. In the left-side navigation pane, choose Cluster Information.
-
On the Cluster Information page, click the Basic Information tab. In the Cluster Information section, find API Server Internal Endpoint and click Set access control on the right. The SLB access control configuration page opens.
-
Turn on the Access Control switch, configure the access control method, select a network access control list, and click OK.
To enable access control, first Create a network access control list, and then Enable access control.
Important-
When configuring a whitelist, you must include the ACS-managed CIDR block
100.104.0.0/16and the vSwitch CIDR block where your nodes reside. -
When configuring a blacklist, you must not include the ACS-managed CIDR block
100.104.0.0/16or the vSwitch CIDR block where your nodes reside.
-