<p>In my company we have few public websites and many internal webapps. Currently they are are running in different AWS security groups.</p>

<p>Is it possible to run both kind of services on the same OpenShift cluster and make sure internal services are not accessible from the Internet?</p>

<p>Thanks!</p>

<p>The traditional(?) way that is solved is through Internet-facing ELB/ALBs pointed to the NodePorts on the cluster. I personally haven't tried <code>Service</code> of <code>kind: LoadBalancer</code> since 1.2 to be able to speak to its functionality, but I do know kubernetes has a <strong>lot</strong> of users on AWS, so it's plausible it works fine by now.</p>

<p>You can also run your own Ingress Controller, several of which have support for ip white/black listing, authentication, SSL/TLS, all the fancy toys, if you'd prefer not to deal with the ELB headache.</p>

<p>If you're not already considering it, <a href="https://docs.projectcalico.org/v2.6/reference/architecture/" rel="nofollow noreferrer">Calico SDN</a> has support for in-cluster networking policies, so you could also apply an extra level of locked-down-ness to ensure no Internet app breaks out of its allowed network path; thus, security-groups moving down into the cluster.</p>
