--- title: Should the Kubernetes API still be exposed to the public... description: A discussion raises the question of whether the Kubernetes API server should still be exposed to the public internet, given that most teams already invest... canonical: https://daily.dev/posts/should-the-kubernetes-api-still-be-exposed-to-the-public-internet--7gxkn2hfc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Should the Kubernetes API still be exposed to the public internet? | daily.dev og:description: A discussion raises the question of whether the Kubernetes API server should still be exposed to the public internet, given that most teams already invest... og:url: https://daily.dev/posts/should-the-kubernetes-api-still-be-exposed-to-the-public-internet--7gxkn2hfc og:image: https://api.daily.dev/og/posts/7gxKn2hFc.png og:image:alt: Should the Kubernetes API still be exposed to the public internet? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Should the Kubernetes API still be exposed to the public internet? **[DevOps & Platform Engineering Hub](https://daily.dev/sources/sanjay)** · [@divyansh30](https://daily.dev/divyansh30) · 1 min read · 1 upvotes · 1 comments ## Summary A discussion raises the question of whether the Kubernetes API server should still be exposed to the public internet, given that most teams already invest heavily in RBAC, network policies, and admission controllers. The author polls readers on whether their API servers are public or private and how they restrict access (VPN, bastion, Zero Trust), while linking to a guide describing how to use Cloudflare Zero Trust, WARP, and Cloudflare Tunnel to provide private API access without a traditional VPN. ## Content Many teams spend months hardening Kubernetes workloads with RBAC, Network Policies, and admission controllers, yet the API server is still accessible from the public internet. It made me wonder whether exposing the control plane should still be considered the standard approach. How is your team handling this today? - Is your Kubernetes API public or private? - Do developers connect through a VPN, bastion host, or a Zero Trust solution? - If you were building a new production cluster today, would you expose the API publicly? I found a guide that explains one approach using **Cloudflare Zero Trust**, **WARP**, and **Cloudflare Tunnel** to provide private Kubernetes API access without relying on a traditional VPN. [https://www.kubeblogs.com/private-kubernetes-api-cloudflare-zero-trust-warp/](https://www.kubeblogs.com/private-kubernetes-api-cloudflare-zero-trust-warp/) I'd be interested to hear what approach has worked best for your team. #DevOps #PlatformEngineering #Kubernetes #CloudSecurity #ZeroTrust #CloudNative ## Community discussion Top comments from developers on daily.dev. **@cjbaccus** · 0 upvotes > Good discussion to have! ## Similar posts on daily.dev - [I don't expose my home server anymore: I let Tailscale do the scary part](https://daily.dev/posts/i-don-t-expose-my-home-server-anymore-i-let-tailscale-do-the-scary-part-xccmpdrgo) · XDA Developers · 0 upvotes · 0 comments - [Kubernetes Networking Explained Without the Hand-Waving](https://daily.dev/posts/kubernetes-networking-explained-without-the-hand-waving-b9yscwngi) · Medium · 5 upvotes · 1 comments - [A blueprint for zero-trust AI on Kubernetes](https://daily.dev/posts/a-blueprint-for-zero-trust-ai-on-kubernetes-s2atvcbqh) · CNCF · 0 upvotes · 0 comments - [How do you secure access to your self-hosted/homelab services?](https://daily.dev/posts/how-do-you-secure-access-to-your-self-hosted-homelab-services--6rlyvh8et) · Lobsters · 1 upvotes · 0 comments - [I stopped exposing half my self-hosted services to the internet, and nothing broke](https://daily.dev/posts/i-stopped-exposing-half-my-self-hosted-services-to-the-internet-and-nothing-broke-rkh9wdjn9) · XDA Developers · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#kubernetes](https://daily.dev/tags/kubernetes), [#cloudflare](https://daily.dev/tags/cloudflare), [#platform-engineering](https://daily.dev/tags/platform-engineering) [View this post on daily.dev](https://daily.dev/posts/should-the-kubernetes-api-still-be-exposed-to-the-public-internet--7gxkn2hfc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/should-the-kubernetes-api-still-be-exposed-to-the-public-internet--7gxkn2hfc","headline":"Should the Kubernetes API still be exposed to the public internet?","text":"A discussion raises the question of whether the Kubernetes API server should still be exposed to the public internet, given that most teams already invest heavily in RBAC, network policies, and admission controllers. The author polls readers on whether their API servers are public or private and how they restrict access (VPN, bastion, Zero Trust), while linking to a guide describing how to use Cloudflare Zero Trust, WARP, and Cloudflare Tunnel to provide private API access without a traditional VPN.","url":"https://daily.dev/posts/should-the-kubernetes-api-still-be-exposed-to-the-public-internet--7gxkn2hfc","datePublished":"2026-08-03T02:41:07.534Z","dateModified":"2026-09-13T20:53:15.280Z","author":{"@type":"Person","name":"Divyansh","url":"https://daily.dev/divyansh30","image":"https://media.daily.dev/image/upload/s--f9lbkpFv--/f_auto/v1744873189/avatars/avatar_JMQ4qarKTe7zPurSPRrzM","description":"Aspiring engineer with an interest in AI, tech and DevOps :)","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":1050}},"image":"https://media.daily.dev/image/upload/s--I4lQH_88--/f_auto/v1785724867/posts/7gxKn2hFc?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"comment":[{"@type":"Comment","text":"Good discussion to have!","datePublished":"2026-08-03T16:55:06.447Z","url":"https://daily.dev/posts/7gxKn2hFc#c-5m3ZwHUSj","author":{"@type":"Person","name":"Carl Baccus","url":"https://daily.dev/cjbaccus","image":"https://avatars.githubusercontent.com/u/1283307?v=4"}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/sanjay","name":"DevOps & Platform Engineering Hub"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps & Platform Engineering Hub","item":"https://daily.dev/squads/sanjay"},{"@type":"ListItem","position":3,"name":"Should the Kubernetes API still be exposed to the public internet?"}]} ```