Kubernetes v1.36 Deprecates Service ExternalIPs Field

Deprecation of Service ExternalIPs

Kubernetes v1.36 marks the formal deprecation of the .spec.externalIPs field for Service resources. This functionality was originally designed to provide load-balancer-like behavior for non-cloud environments. However, it was found to assume that all users in a cluster are trusted, leading to potential security exploits.

Background on Security Concerns

The security risks related to the use of .spec.externalIPs have been acknowledged since at least Kubernetes 1.21. The Kubernetes project has recommended that users disable this field, and introduced the DenyServiceExternalIPs admission controller to facilitate this. Despite this recommendation, the feature remained due to concerns about significant breaking changes.

Alternatives for Load Balancing

With the deprecation of .spec.externalIPs, users are encouraged to explore better alternatives for obtaining load-balancer-like functionality in non-cloud clusters. These alternatives address the inherent security risks that come with using external IPs. Users are also advised to consider enabling the DenyServiceExternalIPs admission controller as a precaution.

Future Updates

Future minor releases of Kubernetes are expected to remove the implementation of the .spec.externalIPs behavior from kube-proxy and adjust conformance criteria to prohibit support for the field. This indicates a shift toward a more secure default setting within the Kubernetes ecosystem.