This message was deleted.

those are the service’s node ports. That is how loadbalancer services work on kubernetes. So no, you can’t suppress that. That is the port on the nodes that the loadbalancer sends traffic to.

ah, but the 30xxx ports could/should be firewalled to only allow traffic from the loadbalancer instead of being generally open?

well generally the cluster members aren’t deployed somewhere that’s just got all ports open to the world so yeah

well but thats my problem it opens the 4 ports to the world automatically, and as far as I can tell without any constraints 🙂

don’t use iptables on the node as the only security layer. Kubernetes kinda assumes you have external security controls, like a border firewall, or cloud security groups, or something like that. It wants to be pretty much the only thing on the node managing iptables rules.

hmm, what if I run baremetal k3s? 😉 but yeah I get your point

You can disable the Nodeport creation when deploying a load balancer https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation

ah there you go. upstream docs ftw