How to ensure access inside the cluster?

Access to the inside of a cluster (e.g., Kubernetes) can be provided in several ways, depending on the purpose of access (user, application, maintenance).

Main methods:

• Ingress: For external HTTP/HTTPS access to services in the cluster via domain name. Works at L7 level.
• NodePort: Opens a port on all cluster nodes, which redirects traffic to the corresponding service. Simple, but poorly scalable and requires knowledge of node IP addresses.
• LoadBalancer: Creates an external load balancer in the cloud (if the cluster is deployed in the cloud), which directs traffic to the service. Comes with additional costs.
• Port Forwarding: A temporary method for debugging. Redirects a port from the local machine to a pod's port inside the cluster.
• kubectl exec: Allows executing a command inside a running container of a pod. Used for interactive access or one-time commands.
• VPN or bastion host: Creating a secure tunnel or intermediate host for accessing resources inside the private network of the cluster.

# Example Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: my-service
            port:
              number: 80

# Example kubectl port-forward command
# Forwards local port 8080 to port 80 of the pod some-pod
kubectl port-forward some-pod 8080:80

The choice of method depends on the specific use case, security requirements, and cluster infrastructure. For production environments, it is preferable to use Ingress and LoadBalancer for service access. For administration and debugging, kubectl exec and port-forward are actively used. VPNs or bastion servers are often used to secure access to the internal network of the cluster.