To add a control plane firewall when creating a cluster, set the --enable-control-plane-firewall flag to true and specify the IP addresses in the --control-plane-firewall-allowed-addresses flag.
The following example creates a cluster with a control plane firewall enabled:
doctl kubernetes cluster create example-cluster \
--region nyc1 \
--version 1.33.1-do.0 \
--enable-control-plane-firewall=true \
--control-plane-firewall-allowed-addresses="1.2.3.4/32, 2.3.0.0/16"
To add a control plane firewall to an existing cluster, use the doctl kubernetes cluster update command. Set the --enable-control-plane-firewall flag to true and specify the IP addresses in the --control-plane-firewall-allowed-addresses flag. For example:
doctl kubernetes cluster update example-cluster \
--enable-control-plane-firewall=true \
--control-plane-firewall-allowed-addresses="1.2.3.4/32, 2.3.0.0/16"
To add a control plane firewall when creating a cluster, send a POST request to https://api.digitalocean.com/v2/kubernetes/clusters with the following request body:
curl --location 'https://api.digitalocean.com/v2/kubernetes/clusters' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer $DIGITALOCEAN_TOKEN' \
--data '{
"name": "example-cluster",
"region": "nyc1",
"version": "1.33.1-do.0",
"node_pools": [
{
"size": "s-1vcpu-2gb",
"count": 3,
"name": "worker-pool"
}
],
"control_plane_firewall": {
"enabled": true,
"allowed_addresses": [
"1.2.3.4/32",
"2.3.0.0/16"
]
}
}'
To add a control plane firewall to an existing cluster, send a PUT request to https://api.digitalocean.com/v2/kubernetes/clusters/<cluster_id> with the following request body:
curl --location --request PUT 'https://api.digitalocean.com/v2/kubernetes/clusters/use_your_cluster_id' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer $DIGITALOCEAN_TOKEN' \
--data '{
"control_plane_firewall": {
"enabled": true,
"allowed_addresses": [
"1.2.3.4/32"
]
}
}'
Go developers can use Godo, the official DigitalOcean V2 API client for Go. To add a control plane firewall when creating a Kubernetes cluster with Godo, use the following code:
package main
import (
"context"
"github.com/digitalocean/godo"
)
func main() {
client := godo.NewFromToken("use_your_digitalocean_token")
enabled := true
_, _, _ = client.Kubernetes.Create(context.Background(), &godo.KubernetesClusterCreateRequest{
Name: "example-cluster",
RegionSlug: "nyc1",
VersionSlug: "1.33.1-do.0",
NodePools: []*godo.KubernetesNodePoolCreateRequest{
{
Name: "worker-pool",
Count: 3,
Size: "s-1vcpu-2gb",
},
},
ControlPlaneFirewall: &godo.KubernetesControlPlaneFirewall{
Enabled: &enabled,
AllowedAddresses: []string{
"1.2.3.4/32",
"2.3.0.0/16",
},
},
})
}
To add a control plane firewall to an existing cluster with Godo, use the following code:
package main
import (
"context"
"github.com/digitalocean/godo"
)
func main() {
client := godo.NewFromToken("use_your_digitalocean_token")
enabled := true
_, _, _ = client.Kubernetes.Update(context.Background(), "use_your_cluster_id", &godo.KubernetesClusterUpdateRequest{
ControlPlaneFirewall: &godo.KubernetesControlPlaneFirewall{
Enabled: &enabled,
AllowedAddresses: []string{
"1.2.3.4/32",
},
},
})
}
To add a control plane firewall when creating a cluster with the DigitalOcean Terraform provider, include the control_plane_firewall block in your digitalocean_kubernetes_cluster resource:
resource "digitalocean_kubernetes_cluster" "example" {
name = "example-cluster"
region = "nyc1"
version = "1.33.1-do.0"
node_pool {
name = "worker-pool"
size = "s-1vcpu-2gb"
node_count = 3
}
control_plane_firewall {
enabled = true
allowed_addresses = ["1.2.3.4/32", "2.3.0.0/16"]
}
}