API server exposure¶
Choose how you reach the Kubernetes API: from your private network only, or over the public Internet. This is the API hostname kubectl uses. It is not an Elastic IP (an address for your applications) and it is not application reachability (Private (VPN) vs Internet), which is fixed at create.
Who can do this: a member can read the current mode. Switching it requires super_admin, and the cluster must be Ready.
What each mode means¶
| Mode | Who can reach the Kubernetes API | What the Access tab shows |
|---|---|---|
| Private | Only from your private network (VPN or Direct Connect) | API endpoint (VPN / Direct Connect): https://<address>:6443 |
| Public | Anyone who can present a valid kubeconfig. HTTPS on port 443 | A hostname under clusters.dks.door.africa, with no port |
Door assigns the public hostname. You do not pick the label. The first time you turn Public on, Door allocates it and keeps the same hostname if you later switch to Private and back.
Example shape for cluster payments-prod in organization acme:
On create, leave the control on the default. That default is Public. Choose Private on the create wizard if the API must stay off the Internet. Public exposure is enabled in Abidjan.
Changing exposure in the console¶
Access tab in the demo organization (cluster cp-canary-in), Cluster Access Private, so the page shows the VPN / Direct Connect endpoint.
- Open the cluster. Its status must be Ready.
- Open Access & kubeconfig.
- Use Private / Public under Cluster Access.
- When the mode is public, copy the hostname. When it is private, use the VPN endpoint on the page.
- Download kubeconfig again, or run
doorctl kubectl configagain. The server address has changed.
Changing exposure with Maya¶
Make the Kubernetes API of payments-prod public.
Switch the API of payments-prod to private.
Maya requests the change and tells you when it has been accepted. When the Access tab shows the new address, download kubeconfig again.
Next
The exposure request for scripts is in the API reference.