<p>My Situation at the moment:
I'm setting up a mail server and just after getting it to work, the logs are flooded with <code>authentication failed</code> messages from an suspicious iran network trying to login to random accounts.</p>
<p>After some googeling I found out that <code>fail2ban</code> can stop those attacks, but there's one problem: how to use fail2ban in kubernetes?
My Ideas:</p>
<ul>
<li>I found <a href="https://pilot.traefik.io/plugins/280093067746214409/fail2-ban" rel="nofollow noreferrer">this plugin</a> for traefik, but it requres the traefik instance to be connected to thei SaaS managment service, what I don't need</li>
<li>Installing <code>fail2ban</code> on the host: As kubernetes connects multiole nodes, <code>fail2ban</code> on node 1 only gets the logs from this node and cannot block traffik coming in on node 2.</li>
</ul>
<p>Is there a solution to run fail2ban In kubernetes, maybe linked to the ingress controller, as it is possible with  traefik, but without any connection to a SaaS provider?</p>

8bit
<p>There isn't really a good way to do this. Both on the log access front, and more importantly on tweaking the iptables rules from inside a container. You could definitely use the core engine of fail2ban to build a tool around the k8s native APIs (<code>pods/logs</code>, NetworkPolicy) however I don't know any such project at time of writing.</p>
