After building a new container image in a GitHub Actions workflow, I would like to deploy it to a Kubernetes cluster (hosted in AKS) via the k8s-deploy action.

This requires the cluster to be reachable from the IP address of a GitHub-hosted runner. My cluster is not generally supposed to be reachable from the public internet.

Github has published ranges of IP addresses of GitHub-hosted runners; however, right now, these are the ranges of entire Azure regions. Thus, locking down cluster access to those IP ranges is not secure.

Is there a recommended way to add an additional layer of security which prevents cluster access from IPs inside those IP ranges, but not from a Github-hosted runner?

  • 1
    This isn't a solution to the question you posed, but I had a similar problem (albeit not on AKS) and solved it by using Github Actions Self-hosted Runners in my private cloud. They don't require inbound whitelisting; they can be in a private subnet and query Github for jobs via a NAT gateway. help.github.com/en/actions/hosting-your-own-runners/… – Woodland Hunter Jun 22 '20 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.