Open-data portal ops wonders whether worker nodes need a public internet VIP for the API or only private reachability. What is required?
Select an answer to reveal the explanation.
Short Explanation
Workers need a reliable private line to the API front desk—not a billboard on the public internet. Reach the control-plane endpoint over your civic network. Publishing kubelets or worker IPs to the world is unnecessary for that.
Full Explanation
Open-data portal workers need reliable network reachability to the control-plane API endpoint; public Internet exposure is not a Kubernetes requirement. A private civic path to a VIP or internal load balancer is enough when DNS and firewalls allow TCP 6443—workers need a private line to the API desk, not a public billboard. Requiring every worker to own a public IPv4 solely to reach GitHub Container Registry confuses optional image-pull routing with API membership prerequisites. Binding the API server only to 127.0.0.1 and forcing eternal SSH tunnels prevents normal remote kubelet operation unless another reachable endpoint exists. Exposing kubelets on 0.0.0.0/0 to the public Internet adds attack surface and is not required for cluster join or steady-state operation. Exam caveat: Distinguish reachable API endpoint from publicly routable on the Internet. Operational check: From each worker, resolve and TCP-connect to the internal controlPlaneEndpoint on 6443, keep kubelet ports off the public Internet per baseline, and confirm Nodes remain Ready without public worker addresses. In municipal platform operations, document this decision in the change record so the next on-call engineer understands why the chosen control exists and which failure modes the rejected options would introduce for city services that depend on this cluster behavior.