Project: KICS (Provisioning / Security & Compliance)
File: 2a52567c-abb8-4651-a038-52fa27c77aed.md

title: Service With External Load Balancer hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2a52567c-abb8-4651-a038-52fa27c77aed Query name: Service With External Load Balancer Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Service has an external load balancer, which may cause accessibility from other networks and the Internet<br> ```tf title="Positive test num. 1 - tf file" hl_lines="24 4" resource "kubernetes_service" "example1" { metadata { name = "terraform-example1" annotations = { "service.beta.kubernetes.io/aws-load-balancer-internal" = "false" } } spec { selector = { app = kubernetes_pod.example.metadata.0.labels.app } session_affinity = "ClientIP" port { port = 8080 target_port = 80 } type = "LoadBalancer" } } resource "kubernetes_service" "example2" { metadata { name = "terraform-example2" } spec { selector = { app = kubernetes_pod.example.metadata.0.labels.app } session_affinity = "ClientIP" port { port = 8080 target_port = 80 } type = "LoadBalancer" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="25 4 46" resource "kubernetes_service" "example2" { metadata { name = "terraform-example2" annotations = { "service.beta.kubernetes.io/azure-load-balancer-internal" = "false" } } spec { selector = { app = kubernetes_pod.example.metadata.0.labels.app } session_affinity = "ClientIP" port { port = 8080 target_port = 80 } type = "LoadBalancer" } } resource "kubernetes_service" "example3" { metadata { name = "terraform-example3" annotations = { "networking.gke.io/load-balancer-type" = "External" } } spec { selector = { app = kubernetes_pod.example.metadata.0.labels.app } session_affinity = "ClientIP" port { port = 8080 target_port = 80 } type = "LoadBalancer" } } resource "kubernetes_service" "example4" { metadata { name = "terraform-example4" annotations = { "cloud.google.com/load-balancer-type" = "External" } } spec { selector = { app = kubernetes_pod.example.metadata.0.labels.app } session_affinity = "ClientIP" port { port = 8080 target_port = 80 } type = "LoadBalancer" } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetes_service" "example3" { metadata { name = "terraform-example3" annotations = { "service.beta.kubernetes.io/aws-load-balancer-internal" = "true" } } spec { selector = { app = kubernetes_pod.example.metadata.0.labels.app } session_affinity = "ClientIP" port { port = 8080 target_port = 80 } type = "LoadBalancer" } } ``` ```tf title="Negative test num. 2 - tf file" resource "kubernetes_service" "example2" { metadata { name = "terraform-example2" annotations = { "service.beta.kubernetes.io/azure-load-balancer-internal" = "true" } } spec { selector = { app = kubernetes_pod.example.metadata.0.labels.app } session_affinity = "ClientIP" port { port = 8080 target_port = 80 } type = "LoadBalancer" } } resource "kubernetes_service" "example3" { metadata { name = "terraform-example3" annotations = { "networking.gke.io/load-balancer-type" = "Internal" } } spec { selector = { app = kubernetes_pod.example.metadata.0.labels.app } session_affinity = "ClientIP" port { port = 8080 target_port = 80 } type = "LoadBalancer" } } resource "kubernetes_service" "example4" { metadata { name = "terraform-example4" annotations = { "cloud.google.com/load-balancer-type" = "Internal" } } spec { selector = { app = kubernetes_pod.example.metadata.0.labels.app } session_affinity = "ClientIP" port { port = 8080 target_port = 80 } type = "LoadBalancer" } } ```