<p>I'm hosting my frontend &amp; backend servers with GKE (Gcloud Kubernetes Engine) with private nodes in a default VPC network like this</p>
<pre class="lang-sh prettyprint-override"><code>gcloud beta container clusters create-auto my-production-cluster \
        --enable-private-nodes \
        --network &quot;projects/$PROJECT_ID/global/networks/default&quot; \
        --subnetwork &quot;projects/$PROJECT_ID/regions/$_GKE_LOCATION/subnetworks/default&quot; \
        --cluster-ipv4-cidr &quot;/17&quot; \
        --services-ipv4-cidr &quot;/22&quot;
</code></pre>
<p>I ssh pods using <code>kubectl</code> like this:</p>
<pre class="lang-sh prettyprint-override"><code>gcloud container clusters get-credentials my-production-cluster
kubectl exec --stdin --tty my-pod-abcd-xyz -- bash 
</code></pre>
<p><strong>So my question is:</strong></p>
<ol>
<li>Is that safe? Can hackers access our cluster &amp; pods somehow?</li>
<li>If it's not safe, what should I do to improve it?</li>
<li>Does a bastion host provide any benefit in my case? AFAIK, it doesn't because the cluster exposes only ports that I specify (ingress &amp; load balancer). I only specify port 80 for Cloudflare HTTPS mapping</li>
</ol>

Terry Tú Nguyễn
<p>It's a best practice to deploy a private cluster. That means the control plane and the workers are private and you haven't public IP, so, no public access and hackers from the internet can't access them.</p>
<p>If you want to access to that internal resource, you must be in the internal network. A common way is to have a bastion with a leg in public access, and another one in the internal network.</p>
<p>Another solution, if you want to interact with the control plane, is to allow <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/authorized-networks" rel="nofollow noreferrer">authorized network</a> to whitelist some IPs allowed to access the control plane. I don't like that solution but it exists!</p>
<p>In terms of security, yes it's safer to keep your internal resources internal, but even in case of public exposure you must have an authorized credential to access your control plane. It's an additional layer of security!</p>
<hr />
<p>Then, for your services, you can expose them externally through Load Balancer and Ingress config in K8S. No bastion requirement for the services.</p>
