SSH Only From In Cluster

[damaestro]

Automatically update firewall policy to only allow connections to ssh from the nodes in the cluster.

[linux-modder]

Would a .j2 that is added dynamically pushed on creation/re-initialization ?

If so, do we want/able to keep the old deployments settings without creating issues with the new k8s deployment?

[damaestro]

This will be done at the GCP level, not the guest level. This is specifically referencing ssh on the cluster nodes themselves. This change would be to pragmatically add intra-cluster ssh firewall policy for GCP and remove the current default allow.

[damaestro]

Let google secure it or move to a private gke cluster in a vpc with the new nat gateway.