Kubernetes API ACL

The ACL (Access Control List) extension lets you restrict which source networks are allowed to reach the Kubernetes API server of your cluster. By default the API server is reachable from any network, and access is protected by authentication and authorization only. With the ACL extension enabled, requests are additionally filtered by their source IP address: only requests coming from the IP ranges (CIDRs) you allow — plus a small set of plusserver default networks (see the note below) — can reach the API server. All other requests are rejected at the network level.

The extension is the open-source Gardener ACL extension and is configured in the Shoot spec of your cluster.

How it works

When the extension is enabled, every connection to the API server is checked against your list of allowed CIDRs:

• Requests from an allowed network reach the API server as usual and still require valid credentials — the ACL does not replace authentication or authorization (RBAC).
• Requests from any other network are rejected before they reach the API server. A blocked client cannot establish a connection at all; it does not get a Kubernetes “forbidden” error. A sudden connection failure — rather than an authentication error — is therefore a typical sign that the ACL is blocking the client.

Cluster-internal communication is never affected: the cluster’s own nodes and pods always keep access to the API server, regardless of your allow-list. You therefore only need to list the external networks from which you administer the cluster (for example your office or VPN egress IPs).

Configuration

Edit the Shoot spec of your cluster as described in Shoot Spec, and add the ACL extension as a new entry under spec.extensions — alongside any extensions you already use:

spec:
  extensions:
    - type: acl
      providerConfig:
        rule:
          action: ALLOW
          type: remote_ip
          cidrs:
            - "203.0.113.0/24"
            - "198.51.100.7/32"

After you save the change and the cluster has reconciled, only the listed CIDRs — plus the plusserver default ranges — can reach the API server.

Fields

Note — plusserver default networks

A small set of internal plusserver networks is always allowed in addition to the CIDRs you configure, so that plusserver can continue to operate, monitor and support your managed control plane. These ranges are added automatically and cannot be removed from the allow-list. If you need the exact ranges for a firewall rule or a security audit, please contact plusserver support.

Limitations

• One rule per cluster. The extension supports exactly one ALLOW rule per cluster. You cannot define multiple rules or DENY rules; list every allowed network in the cidrs field of the single rule.

Removing the restriction

To make the API server reachable from any network again, edit the Shoot spec, remove the acl entry from spec.extensions, and let the cluster reconcile.