Helm externalIPs: Manual Configuration Required for Kubernetes Services

Helm does not automatically configure externalIPs for Kubernetes services. When deploying applications through Helm charts, externalIPs must be manually specified in the Service manifest or through templated values, as there is no default automation for this networking configuration.

Contents

• Understanding externalIPs in Kubernetes Services
• Helm’s Approach to externalIPs Configuration
• Manual Configuration Methods in Helm Charts
• Security and Policy Considerations
• Best Practices for Managing externalIPs

Understanding externalIPs in Kubernetes Services

In Kubernetes, a Service acts as an abstraction layer that defines a logical set of Pods and a policy by which to access them. The externalIPs field within a Service specification allows administrators to expose the Service using an external IP address that is not part of the Kubernetes cluster’s network. This capability is particularly valuable for scenarios where you need to provide stable, predictable access to services without relying on cloud provider load balancers or exposing services directly to the internet.

When you define an externalIPs for a Service, Kubernetes creates a mapping between your external IP and the internal cluster IP for that Service. Traffic sent to the external IP is automatically routed to the appropriate backend Pods, effectively giving you a static, externally accessible endpoint for your application. This differs from other Service types like LoadBalancer, which typically relies on cloud provider infrastructure to assign external IPs dynamically.

Helm’s Approach to externalIPs Configuration

Helm, the Kubernetes package manager, does not automatically configure externalIPs for Services. When deploying an application through a Helm chart, the chart must explicitly set the externalIPs field in the Service manifest or provide it via a templated value. This design choice reflects Helm’s philosophy of providing infrastructure-as-code templates rather than making assumptions about networking requirements.

Helm’s templating engine allows for flexible configuration of externalIPs through various methods:

1. Hardcoded in chart templates: The externalIPs can be directly specified in the Service template files within the Helm chart
2. Configurable via values.yaml: The chart can be designed to accept externalIPs as configurable parameters through the values.yaml file
3. Passed during installation: ExternalIPs can be specified during Helm installation using the --set flag or through environment-specific values files

This approach ensures that networking requirements are explicitly defined and version-controlled alongside the application deployment, promoting infrastructure as a best practice in Kubernetes environments.

Manual Configuration Methods in Helm Charts

1. Direct Template Configuration

The most straightforward method is to hardcode the externalIPs directly in the Service template:

# templates/service.yaml
apiVersion: v1
kind: Service
metadata:
 name: {{ include "myapp.fullname" . }}
 labels:
 {{- include "myapp.labels" . | nindent 4 }}
spec:
 type: {{ .Values.service.type }}
 externalIPs:
 - 192.168.1.100
 - 192.168.1.101
 ports:
 - port: {{ .Values.service.port }}
 targetPort: http
 protocol: TCP
 name: http
 selector:
 {{- include "myapp.selectorLabels" . | nindent 4 }}

2. Values-Based Configuration

A more flexible approach is to make externalIPs configurable through the values.yaml file:

# values.yaml
service:
 type: ClusterIP
 port: 80
 externalIPs:
 - 192.168.1.100
 - 192.168.1.101

Then reference these values in the template:

# templates/service.yaml
apiVersion: v1
kind: Service
metadata:
 name: {{ include "myapp.fullname" . }}
 labels:
 {{- include "myapp.labels" . | nindent 4 }}
spec:
 type: {{ .Values.service.type }}
 externalIPs: {{ .Values.service.externalIPs }}
 ports:
 - port: {{ .Values.service.port }}
 targetPort: http
 protocol: TCP
 name: http
 selector:
 {{- include "myapp.selectorLabels" . | nindent 4 }}

3. Environment-Specific Configuration

For different environments, you can use separate values files:

# Install with production external IPs
helm install myapp ./myapp-chart -f values-production.yaml

# values-production.yaml
service:
 externalIPs:
 - 192.168.1.100
 - 192.168.1.101

# Install with staging external IPs
helm install myapp ./myapp-chart -f values-staging.yaml

# values-staging.yaml
service:
 externalIPs:
 - 192.168.1.200

4. Dynamic External IP Assignment

In some cases, you might need to dynamically assign external IPs based on the environment. Helm’s templating capabilities allow for conditional logic:

# templates/service.yaml
apiVersion: v1
kind: Service
metadata:
 name: {{ include "myapp.fullname" . }}
 labels:
 {{- include "myapp.labels" . | nindent 4 }}
spec:
 type: {{ .Values.service.type }}
 {{- if .Values.service.externalIPs }}
 externalIPs:
 {{- toYaml .Values.service.externalIPs | nindent 4 }}
 {{- end }}
 ports:
 - port: {{ .Values.service.port }}
 targetPort: http
 protocol: TCP
 name: http
 selector:
 {{- include "myapp.selectorLabels" . | nindent 4 }}

This allows you to deploy the same chart with or without externalIPs depending on your values configuration.

Security and Policy Considerations

Using externalIPs for Kubernetes services introduces important security considerations that administrators must carefully evaluate. ExternalIPs can potentially expose services to unwanted traffic if not properly secured and controlled.

Security Risks

“Disabled by default, use of ExternalIP functionality can be a security risk,” as noted in the OKD documentation. When you expose a service via an externalIP, you’re essentially making it accessible from anywhere on the network, bypassing some of the Kubernetes network policies that might otherwise protect your services.

Policy Controls

In enterprise environments like OKD/OpenShift, administrators can control the use of externalIPs through policy controls:

1. Network Policies: Implement Kubernetes Network Policies to restrict which sources can access services exposed via externalIPs
2. CIDR Restrictions: Configure the autoAssignCIDRs setting to control which IP ranges can be used for externalIPs
3. RBAC Controls: Use Role-Based Access Control to limit which users or service accounts can create Services with externalIPs

OKD/OpenShift Specific Considerations

In OKD environments, “OKD automatically assigns an IP address from the autoAssignCIDRs CIDR block to the spec.externalIPs[] array when you create a Service object with spec.type=LoadBalancer set.” This automatic assignment provides a controlled mechanism for externalIP management in enterprise Kubernetes distributions.

Administrators should carefully consider whether to enable externalIP functionality in their clusters and establish clear policies for its use. In many cases, alternative approaches like Ingress controllers or VPN-based access may provide better security outcomes than direct exposure via externalIPs.

Best Practices for Managing externalIPs

Effectively managing externalIPs in Helm deployments requires careful planning and adherence to established best practices. These guidelines help ensure that your externalIP configuration is secure, maintainable, and aligned with your organization’s networking requirements.

1. Infrastructure as Code

Treat externalIPs as part of your infrastructure as code by:

• Storing externalIP assignments in version control alongside your Helm charts
• Using environment-specific values files to manage different externalIP assignments
• Implementing change control processes for modifications to externalIP configurations

2. Documentation and Communication

Maintain clear documentation that includes:

• The purpose of each externalIP assignment
• Which services are accessible via each externalIP
• Contact information for the team responsible for each exposed service
• Security requirements and access controls for each externalIP

3. Monitoring and Alerting

Implement monitoring for services exposed via externalIPs:

• Monitor traffic patterns to detect unusual behavior
• Set up alerts for configuration changes
• Track connection metrics to performance issues
• Implement log aggregation for access auditing

4. Lifecycle Management

Plan for the complete lifecycle of externalIP assignments:

• Process for requesting new externalIPs
• Procedure for retiring externalIPs when services are decommissioned
• Strategy for handling IP conflicts and reassignments
• Backup and disaster recovery planning for externally accessible services

5. Alternative Approaches

Consider alternative methods for external access when appropriate:

• Use Ingress controllers with TLS termination for HTTP/HTTPS services
• Implement VPN access for administrative services
• Consider service meshes for more granular access control
• Use cloud provider specific features like AWS PrivateLink or Azure Private Service Endpoints

6. Testing and Validation

Implement thorough testing for externalIP configurations:

• Validate that externalIPs are correctly assigned and accessible
• Test failover behavior when backend services are unavailable
• Verify that security policies are properly enforced
• Performance testing to ensure externalIP access meets requirements

By following these best practices, organizations can leverage the flexibility of externalIPs in Kubernetes while maintaining security and operational efficiency in their Helm-based deployments.

Sources

1. Kubernetes Documentation — Core explanation of externalIPs and Helm’s behavior: https://kubernetes.io/docs/concepts/services-networking/service/
2. OKD Documentation — Security and policy considerations for externalIPs: https://docs.okd.io/4.11/networking/configuring_ingress_cluster_traffic/configuring-externalip.html
3. DevSpace Documentation — Configuration examples for externalIPs in Helm charts: https://www.devspace.sh/component-chart/docs/configuration/service
4. Neo4j Helm Chart Documentation — Practical implementation guidance for externalIP exposure: https://neo4j.com/labs/neo4j-helm/1.0.0/externalexposure/
5. Helm GitHub Issues — Real-world examples of externalIP configuration in Helm: https://github.com/helm/helm/issues/3560

Conclusion

Helm does not automatically configure externalIPs for Kubernetes services—manual specification is always required. When deploying applications through Helm charts, administrators must explicitly define externalIPs in either the Service templates or through configurable values. This explicit configuration approach ensures that networking requirements are version-controlled and transparent, aligning with infrastructure-as-code principles.

The management of externalIPs in Helm deployments involves careful consideration of security implications, policy controls, and operational best practices. Organizations should establish clear guidelines for when and how to use externalIPs, implement appropriate security measures, and maintain proper documentation for all externally accessible services. By treating externalIPs as part of their infrastructure-as-code strategy, teams can ensure that their Kubernetes deployments maintain both flexibility and security when exposing services beyond the cluster boundary.