#8655 is about NodePort, which is one of the sensitive values.

#7893 is about SecurityContextConstraints.

Another reason for an ACL mechanism for LoadBalancer: it typically costs money (~ $20 for 5 rules on GCE, $15 each LB on AWS), and you typically can't create very many per cloud account (on AWS, the default limit is 20 per region).

cc @derekwaynecarr

We can quota usage of both load balancers and node ports in a namespace to
ensure that a namespace cannot consume any. I will get an example quota
soon.

On Wednesday, May 25, 2016, Brian Grant notifications@github.com wrote:

cc @derekwaynecarr https://github.com/derekwaynecarr

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#8723 (comment)

@erictune - an example doing this with quota:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: quota
spec:
  hard:
    services.nodeports: "2"
    services.loadbalancers: "2"

You can set either to 0 to prevent consumption of either.

This is new to kube 1.3 - thanks to @sdminonne

yep, @derekwaynecarr not sure if I've to do something for release notes on #24247 and #22154

You should be fine. Both are labeled release note.

On Thursday, May 26, 2016, Dario Minonne notifications@github.com wrote:

yep, @derekwaynecarr https://github.com/derekwaynecarr not sure if I've
to do something for release notes on #24247
#24247 and #22154
#22154

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#8723 (comment)

thanks

Quota seems good for nodePort.

For LoadBalancer, I was hoping we could express this via RBAC. Some roles can expose things to the internets, and some can't.

For now quota handles this pretty effectively.

quota and admission webhooks cover this for now