Unexpected k8s nodeport connection

​

Event Information

​

Meaning

• The Unexpected K8s NodePort Connection event indicates that a connection has been made to a NodePort service in the Kubernetes cluster, which was not expected based on the defined network policies.
• This event could potentially indicate a security breach or unauthorized access attempt, as it suggests that traffic is being directed to a service that should not be accessible from outside the cluster.
• To investigate this event, you can use the following kubectl command to list all the NodePort services in the cluster: kubectl get services --field-selector type=NodePort. This will help identify the specific service that is receiving the unexpected connection.

​

Remediation

1. Identify the affected Kubernetes service and its NodePort value.
   • Use the kubectl get services command to list all services in the cluster.
   • Look for the service with the NodePort value mentioned in the event.
   • Note down the service name and NodePort value.
2. Create a Kubernetes manifest file to update the service.
   • Use the kubectl get service <service-name> -o yaml command to get the current service manifest.
   • Save the output to a file, e.g., service.yaml.
   • Open service.yaml in a text editor.
3. Update the spec.type field in the manifest file.
   • Change the value of spec.type from NodePort to ClusterIP.
   • Save the changes to service.yaml.
4. Apply the updated manifest file to the cluster.
   • Use the kubectl apply -f service.yaml command to apply the changes.
   • Verify that the service has been updated by running kubectl get services again.