<p>I am very new to Traefik and Kubernetes. I installed Traefik through helm (repo: <a href="https://traefik.github.io/traefik-helm-chart/" rel="noreferrer">https://traefik.github.io/traefik-helm-chart/</a>, helm version 3.5.2, chart traefik-9.19.1). Then I wanted to get prometheus metrics from it.</p>
<p>Here is an extract of my values.yaml file:</p>
<pre><code>ports:
  metrics:
    expose: true
    port: 3333
    exposedPort: 3333
    protocol: TCP

additionalArguments:
  - &quot;--metrics.prometheus=true&quot;
  - &quot;--metrics.prometheus.buckets=0.100000, 0.300000, 1.200000, 5.000000&quot;
  - &quot;--metrics.prometheus.addEntryPointsLabels=true&quot;
  - &quot;--metrics.prometheus.addServicesLabels=true&quot;
  - &quot;--entrypoints.metrics.address=:3333/tcp&quot;
  - &quot;--metrics.prometheus.entryPoint=metrics&quot;
</code></pre>
<p>My problem is: this configuration exposes the TCP port 3333 to the Internet. For security reasons, I would prefer to avoid this.</p>
<p>Is there a way to expose port 3333 only to my cluster?</p>

n0n0bstan
<p>Try this:</p>
<pre><code>ports:
  metrics:
    expose: true
    port: 3333
    exposedPort: 3333
    protocol: TCP

env:
- name: POD_IP
  valueFrom:
    fieldRef:
      apiVersion: v1
      fieldPath: status.podIP

additionalArguments:
- &quot;--metrics.prometheus=true&quot;
- &quot;--metrics.prometheus.buckets=0.100000, 0.300000, 1.200000, 5.000000&quot;
- &quot;--metrics.prometheus.addEntryPointsLabels=true&quot;
- &quot;--metrics.prometheus.addServicesLabels=true&quot;
- &quot;--entrypoints.metrics.address=$(POD_IP):3333/tcp&quot;
- &quot;--metrics.prometheus.entryPoint=metrics&quot;
</code></pre>
<p>Traefik will expose metrics only at POD_IP network interface.</p>
<p>And/or additionally, i'd propose to update firewall settings at your workers (iptables, etc...)</p>
