{"id":759,"date":"2025-06-04T14:36:42","date_gmt":"2025-06-04T12:36:42","guid":{"rendered":"https:\/\/www.slash-mnt.com\/?p=759"},"modified":"2026-07-26T19:18:30","modified_gmt":"2026-07-26T17:18:30","slug":"ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif","status":"publish","type":"post","link":"https:\/\/www.slash-mnt.com\/fr\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/","title":{"rendered":"OVHcloud Managed Kubernetes : un Security Group &#8220;default&#8221; trop permissif"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Le service <em>Managed Kubernetes<\/em> propos\u00e9 par OVHcloud est une solution pratique pour d\u00e9l\u00e9guer la gestion du plan de contr\u00f4le Kubernetes, tout en conservant la souplesse d\u2019acc\u00e8s aux n\u0153uds de calcul. Mais cette abstraction ne doit pas compromettre la s\u00e9curit\u00e9 r\u00e9seau \u2013 et c\u2019est justement l\u00e0 que le b\u00e2t blesse.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.slash-mnt.com\/fr\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#Ce_que_nous_voulons\" >Ce que nous voulons<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.slash-mnt.com\/fr\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#Ce_que_fait_OVHcloud_aujourdhui\" >Ce que fait OVHcloud aujourd\u2019hui<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.slash-mnt.com\/fr\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#Une_documentation_qui_ne_rassure_pas\" >Une documentation qui ne rassure pas<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.slash-mnt.com\/fr\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#Ma_solution_avec_OpenTofu\" >Ma solution avec OpenTofu<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.slash-mnt.com\/fr\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#Ce_que_OVHcloud_devrait_faire\" >Ce que OVHcloud devrait faire<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.slash-mnt.com\/fr\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#Conclusion\" >Conclusion<\/a><\/li><\/ul><\/nav><\/div>\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Ce_que_nous_voulons\"><\/span>Ce que nous voulons<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">En tant que clients de ce service, notre attente est simple :<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Un acc\u00e8s s\u00e9curis\u00e9 au cluster Kubernetes, \u00e0 la fois depuis le r\u00e9seau public et depuis le r\u00e9seau priv\u00e9 OVH, via des Security Groups bien d\u00e9finis.<\/strong><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">C\u2019est un pr\u00e9requis \u00e9vident pour tout environnement de production qui prend au s\u00e9rieux la s\u00e9curit\u00e9 r\u00e9seau et la gestion des flux autoris\u00e9s.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Ce_que_fait_OVHcloud_aujourdhui\"><\/span>Ce que fait OVHcloud aujourd\u2019hui<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Lors de la cr\u00e9ation d\u2019un cluster Managed Kubernetes sur OVHcloud, les n\u0153uds de vos pools sont <strong>automatiquement associ\u00e9s au Security Group &#8220;default&#8221;<\/strong> du projet Public Cloud.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Et ce groupe &#8220;default&#8221; est\u2026 inqui\u00e9tant :<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Il autorise par d\u00e9faut <strong>tout le trafic, dans toutes les directions, depuis n\u2019importe quelle adresse IP (<code>0.0.0.0\/0<\/code>)<\/strong>, sur <strong>tous les ports et tous les protocoles<\/strong>.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Autrement dit, <strong>vos n\u0153uds sont expos\u00e9s \u00e0 tout l\u2019Internet<\/strong>, sauf si vous prenez vous-m\u00eame l\u2019initiative de restreindre les flux a posteriori. Ce comportement par d\u00e9faut est tr\u00e8s loin des bonnes pratiques attendues dans un service <em><strong>manag\u00e9<\/strong><\/em>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Un Issue Github a \u00e9t\u00e9 cr\u00e9\u00e9 il y a maintenant 3 ans sur le sujet, et pourtant rien de neuf : <a href=\"https:\/\/github.com\/ovh\/public-cloud-roadmap\/issues\/221#issuecomment-2827845800\">https:\/\/github.com\/ovh\/public-cloud-roadmap\/issues\/221<\/a>. J&#8217;y ai d&#8217;ailleurs apport\u00e9 <a href=\"https:\/\/github.com\/ovh\/public-cloud-roadmap\/issues\/221#issuecomment-2827845800\">ma pierre<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Un autre constat peut \u00eatre fait. OVH popule les instances Public Cloud avec une adresse IP publique, flottante. Dans la grande majorit\u00e9 des cas, ce n&#8217;est pas n\u00e9cessaire. La surface d&#8217;attaque est encore agrandie \u00e0 cause de cela. Est-ce que cela indiquerait qu&#8217;OVH ne sait pas faire autrement pour faire communiquer le Control Plane avec le Data Plane ?<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"478\" src=\"https:\/\/www.slash-mnt.com\/wp-content\/uploads\/2025\/06\/image-1024x478.png\" alt=\"Sch\u00e9ma officiel de l'architecture Kubernetes montrant les composants du Control Plane et des Nodes\" class=\"wp-image-761\" srcset=\"https:\/\/www.slash-mnt.com\/wp-content\/uploads\/2025\/06\/image-1024x478.png 1024w, https:\/\/www.slash-mnt.com\/wp-content\/uploads\/2025\/06\/image-300x140.png 300w, https:\/\/www.slash-mnt.com\/wp-content\/uploads\/2025\/06\/image-768x359.png 768w, https:\/\/www.slash-mnt.com\/wp-content\/uploads\/2025\/06\/image-18x8.png 18w, https:\/\/www.slash-mnt.com\/wp-content\/uploads\/2025\/06\/image.png 1252w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><a href=\"https:\/\/kubernetes.io\/docs\/concepts\/overview\/components\/\"><em>Source : https:\/\/kubernetes.io\/docs\/concepts\/overview\/components\/<\/em><\/a><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Une_documentation_qui_ne_rassure_pas\"><\/span>Une documentation qui ne rassure pas<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Apr\u00e8s avoir consult\u00e9 la page officielle <a href=\"https:\/\/help.ovhcloud.com\/csm\/en-public-cloud-kubernetes-known-limits?id=kb_article_view&amp;sysparm_article=KB0049873#ports\" target=\"_blank\" rel=\"noreferrer noopener\">Managed Kubernetes &#8211; Known Limits # Ports<\/a>, j\u2019esp\u00e9rais trouver une configuration r\u00e9seau plus solide.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Mais non : cette page se contente de lister les ports n\u00e9cessaires au bon fonctionnement d\u2019un cluster (API server, kubelet, etcd\u2026), <strong>sans aucune mention d\u2019un groupe de s\u00e9curit\u00e9 d\u00e9di\u00e9<\/strong> ou d\u2019un m\u00e9canisme de durcissement automatique.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pire : certains ports importants semblent oubli\u00e9s \u2013 notamment le <strong>port TCP 10256<\/strong>, pourtant clairement list\u00e9 dans la documentation Kubernetes officielle : <a class=\"\" href=\"https:\/\/kubernetes.io\/docs\/reference\/networking\/ports-and-protocols\/#node\">Kubernetes ports and protocols<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Ma_solution_avec_OpenTofu\"><\/span>Ma solution avec OpenTofu<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Pour pallier cette faille, j\u2019ai cr\u00e9\u00e9 un ensemble de r\u00e8gles via <strong>OpenTofu<\/strong> permettant de restreindre les flux entrants uniquement aux ports n\u00e9cessaires. Voici les grandes lignes :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Ingress autoris\u00e9 uniquement<\/strong> sur les ports obligatoires :\n<ul class=\"wp-block-list\">\n<li>TCP 22 (SSH, OVH Management)<\/li>\n\n\n\n<li>UDP 8472 (flannel)<\/li>\n\n\n\n<li>UDP 4789 (kube-dns)<\/li>\n\n\n\n<li>TCP 10250 (kubelet)<\/li>\n\n\n\n<li>TCP 10256 (kube-proxy)<\/li>\n\n\n\n<li>TCP 443 (API server via le load balancer)<\/li>\n\n\n\n<li>Tout le TCP sur 10.2.0.0\/16<\/li>\n\n\n\n<li>Tout le TCP sur 10.3.0.0\/16<\/li>\n\n\n\n<li>Tout le UDP sur 10.2.0.0\/16<\/li>\n\n\n\n<li>Tout le UDP sur 10.3.0.0\/16<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Egress autoris\u00e9 en totalit\u00e9<\/strong> (peut \u00eatre restreint selon vos besoins)<\/li>\n\n\n\n<li><strong>NodePort (TCP 30000-32767)<\/strong> non inclus (non recommand\u00e9 en production, nous pr\u00e9f\u00e8rerons l&#8217;utilisation d&#8217;un Load Balancer)<\/li>\n\n\n\n<li><strong>NFS (TCP 111)<\/strong> non inclus plus bas car non utilis\u00e9 dans mon contexte<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Voici donc un template <strong>OpenTofu<\/strong> qui vous aidera \u00e0 combler ce trou de s\u00e9curit\u00e9 :<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro padding-bottom-disabled\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#e1e4e833\" stroke=\"#e1e4e84d\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#e1e4e833\" stroke=\"#e1e4e84d\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#e1e4e833\" stroke=\"#e1e4e84d\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><textarea class=\"code-block-pro-copy-button-textarea\" aria-hidden=\"true\" readonly>resource &#8220;openstack_networking_secgroup_rule_v2&#8221; &#8220;rules&#8221; {\n  for_each = {\n    for index, rule in local.rules: index => rule\n  }\n  security_group_id = &lt;id>\n  description      = each.value.description\n  ethertype        = each.value.ethertype\n  direction        = each.value.direction\n  port_range_min   = each.value.port_range_min\n  port_range_max   = each.value.port_range_max\n  remote_ip_prefix = each.value.remote_ip_prefix\n  protocol         = each.value.protocol\n}\nlocals {\n  rules = [\n    # Outbound\n    {\n      description      = &#8220;Allow TCP traffic to outside (v4)&#8221;\n      protocol         = &#8220;tcp&#8221;\n      direction        = &#8220;egress&#8221;\n      ethertype        = &#8220;IPv4&#8221;\n      port_range_min   = 0\n      port_range_max   = 0\n      remote_ip_prefix = &#8220;0.0.0.0\/0&#8221;\n    },\n    {\n      description      = &#8220;Allow TCP traffic to outside (v6)&#8221;\n      protocol         = &#8220;tcp&#8221;\n      direction        = &#8220;egress&#8221;\n      ethertype        = &#8220;IPv6&#8221;\n      port_range_min   = 0\n      port_range_max   = 0\n      remote_ip_prefix = &#8220;::\/0&#8221;\n    },\n    {\n      description      = &#8220;Allow UDP traffic to outside (v4)&#8221;\n      protocol         = &#8220;udp&#8221;\n      direction        = &#8220;egress&#8221;\n      ethertype        = &#8220;IPv4&#8221;\n      port_range_min   = 0\n      port_range_max   = 0\n      remote_ip_prefix = &#8220;0.0.0.0\/0&#8221;\n    },\n    {\n      description      = &#8220;Allow UDP traffic to outside (v6)&#8221;\n      protocol         = &#8220;udp&#8221;\n      direction        = &#8220;egress&#8221;\n      ethertype        = &#8220;IPv6&#8221;\n      port_range_min   = 0\n      port_range_max   = 0\n      remote_ip_prefix = &#8220;::\/0&#8221;\n    },\n    # Internal Kubernetes and OVH services\n    {\n      description      = &#8220;Allow TCP traffic from pods&#8221;\n      protocol         = &#8220;tcp&#8221;\n      direction        = &#8220;ingress&#8221;\n      ethertype        = &#8220;IPv4&#8221;\n      port_range_min   = 0\n      port_range_max   = 0\n      remote_ip_prefix = &#8220;10.2.0.0\/16&#8221;\n    },\n    {\n      description      = &#8220;Allow TCP traffic from services&#8221;\n      protocol         = &#8220;tcp&#8221;\n      direction        = &#8220;ingress&#8221;\n      ethertype        = &#8220;IPv4&#8221;\n      port_range_min   = 0\n      port_range_max   = 0\n      remote_ip_prefix = &#8220;10.3.0.0\/16&#8221;\n    },\n    {\n      description      = &#8220;Allow UDP traffic from pods&#8221;\n      protocol         = &#8220;udp&#8221;\n      direction        = &#8220;ingress&#8221;\n      ethertype        = &#8220;IPv4&#8221;\n      port_range_min   = 0\n      port_range_max   = 0\n      remote_ip_prefix = &#8220;10.2.0.0\/16&#8221;\n    },\n    {\n      description      = &#8220;Allow UDP traffic from services&#8221;\n      protocol         = &#8220;udp&#8221;\n      direction        = &#8220;ingress&#8221;\n      ethertype        = &#8220;IPv4&#8221;\n      port_range_min   = 0\n      port_range_max   = 0\n      remote_ip_prefix = &#8220;10.3.0.0\/16&#8221;\n    },\n    # OVH and Kubernetes Data Plane\n    {\n      description      = &#8220;Allow SSH for OVH Management (v4)&#8221;\n      protocol         = &#8220;tcp&#8221;\n      direction        = &#8220;ingress&#8221;\n      ethertype        = &#8220;IPv4&#8221;\n      port_range_min   = 22\n      port_range_max   = 22\n      remote_ip_prefix = &#8220;0.0.0.0\/0&#8221;\n    },\n    {\n      description      = &#8220;Allow communication between pods (flannel)&#8221;\n      protocol         = &#8220;udp&#8221;\n      direction        = &#8220;ingress&#8221;\n      ethertype        = &#8220;IPv4&#8221;\n      port_range_min   = 8472\n      port_range_max   = 8472\n      remote_ip_prefix = &#8220;0.0.0.0\/0&#8221;\n    },\n    {\n      description      = &#8220;Allow DNS resolution between nodes (kube-dns internal usage)&#8221;\n      protocol         = &#8220;udp&#8221;\n      direction        = &#8220;ingress&#8221;\n      ethertype        = &#8220;IPv4&#8221;\n      port_range_min   = 4789\n      port_range_max   = 4789\n      remote_ip_prefix = &#8220;0.0.0.0\/0&#8221;\n    },\n    {\n      description      = &#8220;Allow communication between apiserver and worker nodes (kubelet)&#8221;\n      protocol         = &#8220;tcp&#8221;\n      direction        = &#8220;ingress&#8221;\n      ethertype        = &#8220;IPv4&#8221;\n      port_range_min   = 10250\n      port_range_max   = 10250\n      remote_ip_prefix = &#8220;0.0.0.0\/0&#8221;\n    },\n    {\n      description      = &#8220;Allow communication for Load Balancers (kube-proxy)&#8221;\n      protocol         = &#8220;tcp&#8221;\n      direction        = &#8220;ingress&#8221;\n      ethertype        = &#8220;IPv4&#8221;\n      port_range_min   = 10256\n      port_range_max   = 10256\n      remote_ip_prefix = &#8220;0.0.0.0\/0&#8221;\n    }\n  ]\n}<\/textarea><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">resource<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;openstack_networking_secgroup_rule_v2&quot;<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;rules&quot;<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">  <\/span><span style=\"color: #B392F0\">for_each<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    <\/span><span style=\"color: #F97583\">for<\/span><span style=\"color: #E1E4E8\"> index, rule <\/span><span style=\"color: #F97583\">in<\/span><span style=\"color: #E1E4E8\"> local.rules: index =<\/span><span style=\"color: #F97583\">&gt;<\/span><span style=\"color: #E1E4E8\"> rule<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">  }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">  <\/span><span style=\"color: #B392F0\">security_group_id<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #F97583\">&lt;<\/span><span style=\"color: #9ECBFF\">i<\/span><span style=\"color: #E1E4E8\">d<\/span><span style=\"color: #F97583\">&gt;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">  <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">each.value.description<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">  <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">each.value.ethertype<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">  <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">each.value.direction<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">  <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">each.value.port_range_min<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">  <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">each.value.port_range_max<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">  <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">each.value.remote_ip_prefix<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">  <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">each.value.protocol<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">}<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #B392F0\">locals<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">  <\/span><span style=\"color: #B392F0\">rules<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> [<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    <\/span><span style=\"color: #6A737D\"># Outbound<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow TCP traffic to outside (v4)&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;tcp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;egress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv4&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;0.0.0.0\/0&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    },<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow TCP traffic to outside (v6)&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;tcp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;egress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv6&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;::\/0&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    },<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow UDP traffic to outside (v4)&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;udp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;egress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv4&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;0.0.0.0\/0&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    },<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow UDP traffic to outside (v6)&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;udp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;egress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv6&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;::\/0&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    },<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    <\/span><span style=\"color: #6A737D\"># Internal Kubernetes and OVH services<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow TCP traffic from pods&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;tcp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;ingress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv4&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;10.2.0.0\/16&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    },<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow TCP traffic from services&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;tcp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;ingress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv4&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;10.3.0.0\/16&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    },<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow UDP traffic from pods&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;udp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;ingress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv4&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;10.2.0.0\/16&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    },<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow UDP traffic from services&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;udp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;ingress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv4&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;10.3.0.0\/16&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    },<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    <\/span><span style=\"color: #6A737D\"># OVH and Kubernetes Data Plane<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow SSH for OVH Management (v4)&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;tcp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;ingress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv4&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">22<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">22<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;0.0.0.0\/0&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    },<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow communication between pods (flannel)&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;udp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;ingress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv4&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">8472<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">8472<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;0.0.0.0\/0&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    },<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow DNS resolution between nodes (kube-dns internal usage)&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;udp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;ingress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv4&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">4789<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">4789<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;0.0.0.0\/0&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    },<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow communication between apiserver and worker nodes (kubelet)&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;tcp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;ingress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv4&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">10250<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">10250<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;0.0.0.0\/0&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    },<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    {<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">description<\/span><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;Allow communication for Load Balancers (kube-proxy)&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">protocol<\/span><span style=\"color: #E1E4E8\">         <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;tcp&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">direction<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;ingress&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">ethertype<\/span><span style=\"color: #E1E4E8\">        <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;IPv4&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_min<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">10256<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">port_range_max<\/span><span style=\"color: #E1E4E8\">   <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #79B8FF\">10256<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">      <\/span><span style=\"color: #B392F0\">remote_ip_prefix<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">=<\/span><span style=\"color: #E1E4E8\"> <\/span><span style=\"color: #9ECBFF\">&quot;0.0.0.0\/0&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">  ]<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">}<\/span><\/span><\/code><\/pre><span style=\"display:flex;align-items:flex-end;padding:10px;width:100%;justify-content:flex-end;background-color:#24292e;color:#d3d7dd;font-size:12px;line-height:1;position:relative\">Bash<\/span><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Ce_que_OVHcloud_devrait_faire\"><\/span>Ce que OVHcloud devrait faire<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Plusieurs solutions simples pourraient renforcer la s\u00e9curit\u00e9 <strong>par d\u00e9faut<\/strong> :<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Permettre de choisir le Security Group<\/strong> \u00e0 associer aux n\u0153uds lors de la cr\u00e9ation du pool.<\/li>\n\n\n\n<li><strong>Cr\u00e9er automatiquement un Security Group d\u00e9di\u00e9<\/strong>, avec les bonnes r\u00e8gles, lors du provisionnement du cluster.<\/li>\n\n\n\n<li><strong>(re)Documenter pr\u00e9cis\u00e9ment les flux attendus<\/strong>, y compris les ports manquants (ex : TCP 10256).<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Ce sont des pratiques courantes chez d&#8217;autres fournisseurs de Kubernetes manag\u00e9, et elles \u00e9vitent bien des erreurs de configuration de la part des utilisateurs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Conclusion\"><\/span>Conclusion<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Un service manag\u00e9 doit inspirer <strong>confiance<\/strong>. Si la plateforme laisse des ports grands ouverts sur tous vos n\u0153uds, c\u2019est \u00e0 vous \u2013 client \u2013 de colmater les br\u00e8ches. Ce n\u2019est pas acceptable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Je reste convaincu qu\u2019OVHcloud peut et doit faire mieux, notamment en int\u00e9grant cette probl\u00e9matique dans le design de son service. D\u2019autres utilisateurs ont d\u00e9j\u00e0 demand\u00e9 cette \u00e9volution sur les forums, et j\u2019esp\u00e8re qu\u2019elle verra rapidement le jour.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">En attendant, restez vigilants sur vos configurations r\u00e9seau. Un cluster bien configur\u00e9 commence par\u2026 <strong>un Security Group bien pens\u00e9<\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Le service Managed Kubernetes propos\u00e9 par OVHcloud est une solution pratique pour d\u00e9l\u00e9guer la gestion du plan de contr\u00f4le Kubernetes, tout en conservant la souplesse d\u2019acc\u00e8s aux n\u0153uds de calcul. Mais cette abstraction ne doit pas compromettre la s\u00e9curit\u00e9 r\u00e9seau \u2013 et c\u2019est justement l\u00e0 que le b\u00e2t blesse. Ce que nous voulons En tant&hellip;&nbsp;<a href=\"https:\/\/www.slash-mnt.com\/fr\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/\" rel=\"bookmark\">Lire la suite &raquo;<span class=\"screen-reader-text\">OVHcloud Managed Kubernetes : un Security Group &#8220;default&#8221; trop permissif<\/span><\/a><\/p>","protected":false},"author":1,"featured_media":763,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[24,14,29],"tags":[15,11,19],"class_list":["post-759","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-infra-as-code","category-kubernetes","category-ovhcloud","tag-kubernetes","tag-network","tag-securite"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>OVHcloud Managed Kubernetes : un Security Group &quot;default&quot; trop permissif - \/mnt<\/title>\n<meta name=\"description\" content=\"Le service Managed Kubernetes propos\u00e9 par OVHcloud est une solution pratique pour d\u00e9l\u00e9guer la gestion du plan de contr\u00f4le Kubernetes, tout en conservant\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.slash-mnt.com\/fr\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OVHcloud Managed Kubernetes : un Security Group &quot;default&quot; trop permissif - \/mnt\" \/>\n<meta property=\"og:description\" content=\"Le service Managed Kubernetes propos\u00e9 par OVHcloud est une solution pratique pour d\u00e9l\u00e9guer la gestion du plan de contr\u00f4le Kubernetes, tout en conservant\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.slash-mnt.com\/fr\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/\" \/>\n<meta property=\"og:site_name\" content=\"\/mnt\" \/>\n<meta property=\"article:published_time\" content=\"2025-06-04T12:36:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-26T17:18:30+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.slash-mnt.com\/wp-content\/uploads\/2025\/06\/20250604_1428_OVH-Securite-Manquante_simple_compose_01jwxehj1jf2zaz23xm0b8fhks.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1536\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Paul Rey\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Paul Rey\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/2025\\\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/2025\\\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\\\/\"},\"author\":{\"name\":\"Paul Rey\",\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/#\\\/schema\\\/person\\\/c1ab9da41528662641aeeaeae843ce24\"},\"headline\":\"OVHcloud Managed Kubernetes : un Security Group &#8220;default&#8221; trop permissif\",\"datePublished\":\"2025-06-04T12:36:42+00:00\",\"dateModified\":\"2026-07-26T17:18:30+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/2025\\\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\\\/\"},\"wordCount\":1126,\"image\":{\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/2025\\\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.slash-mnt.com\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/20250604_1428_OVH-Securite-Manquante_simple_compose_01jwxehj1jf2zaz23xm0b8fhks.jpg\",\"keywords\":[\"Kubernetes\",\"Network\",\"S\u00e9curit\u00e9\"],\"articleSection\":[\"infra-as-code\",\"kubernetes\",\"OVHcloud\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/2025\\\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\\\/\",\"url\":\"https:\\\/\\\/www.slash-mnt.com\\\/2025\\\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\\\/\",\"name\":\"OVHcloud Managed Kubernetes : un Security Group \\\"default\\\" trop permissif - \\\/mnt\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/2025\\\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/2025\\\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.slash-mnt.com\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/20250604_1428_OVH-Securite-Manquante_simple_compose_01jwxehj1jf2zaz23xm0b8fhks.jpg\",\"datePublished\":\"2025-06-04T12:36:42+00:00\",\"dateModified\":\"2026-07-26T17:18:30+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/#\\\/schema\\\/person\\\/c1ab9da41528662641aeeaeae843ce24\"},\"description\":\"Le service Managed Kubernetes propos\u00e9 par OVHcloud est une solution pratique pour d\u00e9l\u00e9guer la gestion du plan de contr\u00f4le Kubernetes, tout en conservant\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/2025\\\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.slash-mnt.com\\\/2025\\\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/2025\\\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.slash-mnt.com\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/20250604_1428_OVH-Securite-Manquante_simple_compose_01jwxehj1jf2zaz23xm0b8fhks.jpg\",\"contentUrl\":\"https:\\\/\\\/www.slash-mnt.com\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/20250604_1428_OVH-Securite-Manquante_simple_compose_01jwxehj1jf2zaz23xm0b8fhks.jpg\",\"width\":1536,\"height\":1024},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/2025\\\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.slash-mnt.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OVHcloud Managed Kubernetes : un Security Group \u00ab\u00a0default\u00a0\u00bb trop permissif\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/#website\",\"url\":\"https:\\\/\\\/www.slash-mnt.com\\\/\",\"name\":\"\\\/mnt\",\"description\":\"Your hiking guide to the Cloud\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.slash-mnt.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.slash-mnt.com\\\/#\\\/schema\\\/person\\\/c1ab9da41528662641aeeaeae843ce24\",\"name\":\"Paul Rey\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8c4538cce7bce2418ec97551a4f349f8b7ca674bd1c466a0e3101e8c778ded60?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8c4538cce7bce2418ec97551a4f349f8b7ca674bd1c466a0e3101e8c778ded60?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8c4538cce7bce2418ec97551a4f349f8b7ca674bd1c466a0e3101e8c778ded60?s=96&d=mm&r=g\",\"caption\":\"Paul Rey\"},\"sameAs\":[\"https:\\\/\\\/www.slash-mnt.com\"],\"url\":\"https:\\\/\\\/www.slash-mnt.com\\\/fr\\\/author\\\/prey\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"OVHcloud Managed Kubernetes : un Security Group \"default\" trop permissif - \/mnt","description":"Le service Managed Kubernetes propos\u00e9 par OVHcloud est une solution pratique pour d\u00e9l\u00e9guer la gestion du plan de contr\u00f4le Kubernetes, tout en conservant","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.slash-mnt.com\/fr\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/","og_locale":"fr_FR","og_type":"article","og_title":"OVHcloud Managed Kubernetes : un Security Group \"default\" trop permissif - \/mnt","og_description":"Le service Managed Kubernetes propos\u00e9 par OVHcloud est une solution pratique pour d\u00e9l\u00e9guer la gestion du plan de contr\u00f4le Kubernetes, tout en conservant","og_url":"https:\/\/www.slash-mnt.com\/fr\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/","og_site_name":"\/mnt","article_published_time":"2025-06-04T12:36:42+00:00","article_modified_time":"2026-07-26T17:18:30+00:00","og_image":[{"width":1536,"height":1024,"url":"https:\/\/www.slash-mnt.com\/wp-content\/uploads\/2025\/06\/20250604_1428_OVH-Securite-Manquante_simple_compose_01jwxehj1jf2zaz23xm0b8fhks.jpg","type":"image\/jpeg"}],"author":"Paul Rey","twitter_card":"summary_large_image","twitter_misc":{"\u00c9crit par":"Paul Rey","Dur\u00e9e de lecture estim\u00e9e":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.slash-mnt.com\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#article","isPartOf":{"@id":"https:\/\/www.slash-mnt.com\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/"},"author":{"name":"Paul Rey","@id":"https:\/\/www.slash-mnt.com\/#\/schema\/person\/c1ab9da41528662641aeeaeae843ce24"},"headline":"OVHcloud Managed Kubernetes : un Security Group &#8220;default&#8221; trop permissif","datePublished":"2025-06-04T12:36:42+00:00","dateModified":"2026-07-26T17:18:30+00:00","mainEntityOfPage":{"@id":"https:\/\/www.slash-mnt.com\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/"},"wordCount":1126,"image":{"@id":"https:\/\/www.slash-mnt.com\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#primaryimage"},"thumbnailUrl":"https:\/\/www.slash-mnt.com\/wp-content\/uploads\/2025\/06\/20250604_1428_OVH-Securite-Manquante_simple_compose_01jwxehj1jf2zaz23xm0b8fhks.jpg","keywords":["Kubernetes","Network","S\u00e9curit\u00e9"],"articleSection":["infra-as-code","kubernetes","OVHcloud"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/www.slash-mnt.com\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/","url":"https:\/\/www.slash-mnt.com\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/","name":"OVHcloud Managed Kubernetes : un Security Group \"default\" trop permissif - \/mnt","isPartOf":{"@id":"https:\/\/www.slash-mnt.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.slash-mnt.com\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#primaryimage"},"image":{"@id":"https:\/\/www.slash-mnt.com\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#primaryimage"},"thumbnailUrl":"https:\/\/www.slash-mnt.com\/wp-content\/uploads\/2025\/06\/20250604_1428_OVH-Securite-Manquante_simple_compose_01jwxehj1jf2zaz23xm0b8fhks.jpg","datePublished":"2025-06-04T12:36:42+00:00","dateModified":"2026-07-26T17:18:30+00:00","author":{"@id":"https:\/\/www.slash-mnt.com\/#\/schema\/person\/c1ab9da41528662641aeeaeae843ce24"},"description":"Le service Managed Kubernetes propos\u00e9 par OVHcloud est une solution pratique pour d\u00e9l\u00e9guer la gestion du plan de contr\u00f4le Kubernetes, tout en conservant","breadcrumb":{"@id":"https:\/\/www.slash-mnt.com\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.slash-mnt.com\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.slash-mnt.com\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#primaryimage","url":"https:\/\/www.slash-mnt.com\/wp-content\/uploads\/2025\/06\/20250604_1428_OVH-Securite-Manquante_simple_compose_01jwxehj1jf2zaz23xm0b8fhks.jpg","contentUrl":"https:\/\/www.slash-mnt.com\/wp-content\/uploads\/2025\/06\/20250604_1428_OVH-Securite-Manquante_simple_compose_01jwxehj1jf2zaz23xm0b8fhks.jpg","width":1536,"height":1024},{"@type":"BreadcrumbList","@id":"https:\/\/www.slash-mnt.com\/2025\/ovhcloud-managed-kubernetes-un-security-group-default-trop-permissif\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.slash-mnt.com\/"},{"@type":"ListItem","position":2,"name":"OVHcloud Managed Kubernetes : un Security Group \u00ab\u00a0default\u00a0\u00bb trop permissif"}]},{"@type":"WebSite","@id":"https:\/\/www.slash-mnt.com\/#website","url":"https:\/\/www.slash-mnt.com\/","name":"\/mnt","description":"Votre guide montagne vers le Cloud","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.slash-mnt.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Person","@id":"https:\/\/www.slash-mnt.com\/#\/schema\/person\/c1ab9da41528662641aeeaeae843ce24","name":"Paul Rey","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/8c4538cce7bce2418ec97551a4f349f8b7ca674bd1c466a0e3101e8c778ded60?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/8c4538cce7bce2418ec97551a4f349f8b7ca674bd1c466a0e3101e8c778ded60?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8c4538cce7bce2418ec97551a4f349f8b7ca674bd1c466a0e3101e8c778ded60?s=96&d=mm&r=g","caption":"Paul Rey"},"sameAs":["https:\/\/www.slash-mnt.com"],"url":"https:\/\/www.slash-mnt.com\/fr\/author\/prey\/"}]}},"_links":{"self":[{"href":"https:\/\/www.slash-mnt.com\/fr\/wp-json\/wp\/v2\/posts\/759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.slash-mnt.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.slash-mnt.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.slash-mnt.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.slash-mnt.com\/fr\/wp-json\/wp\/v2\/comments?post=759"}],"version-history":[{"count":4,"href":"https:\/\/www.slash-mnt.com\/fr\/wp-json\/wp\/v2\/posts\/759\/revisions"}],"predecessor-version":[{"id":811,"href":"https:\/\/www.slash-mnt.com\/fr\/wp-json\/wp\/v2\/posts\/759\/revisions\/811"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.slash-mnt.com\/fr\/wp-json\/wp\/v2\/media\/763"}],"wp:attachment":[{"href":"https:\/\/www.slash-mnt.com\/fr\/wp-json\/wp\/v2\/media?parent=759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.slash-mnt.com\/fr\/wp-json\/wp\/v2\/categories?post=759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.slash-mnt.com\/fr\/wp-json\/wp\/v2\/tags?post=759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}