<p>On 1.10.9, kops, AWS, I am looking for a way to stop a user from creating a service that uses type:loadbalancer unless it has </p>

<pre><code>annotations: 
  service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0. 
</code></pre>

<p>Is that possible?</p>

<p>A custom role for users , with rules like this:</p>

<pre><code>rules:
- apiGroups: [""]
  resources: ["service"]
  verbs: ["get", "watch", "list"] .   ( dont put create ,update,patch etc)
</code></pre>

<p>This will prevent the users.</p>

<p>Then use <a href="https://github.com/kubermatic/nodeport-exposer" rel="nofollow noreferrer">NodePort-Exposer</a> to do the second part automatically without involving the users.</p>

<p><em>The NodePort-Exposer watches Services with the annotation <strong><code>nodeport-exposer.k8s.io/expose="true"</code></strong> and exposes them via a Service of type LoadBalancer.</em></p>
