Currently, I'm exposing a k8s service using network load balancer. It creates a network load balancer and sets the target group as instance based and everything works fine. As we know port in the nodes is always in the range of 30000 - 32767.

There is a difference in the different target groups. Instance based target group is used to preserve the clientIP, where in IP based doesn't preserve the client IP.

Now there is a problem with the security group, I want to restrict the node ports only be accessible by the CIDR of load balancer. Since it is an instance based target group, inbound IP is always the client IP. So it is difficult to restrict the access only for certain IP's.

So my plan is to switch the target group to "IP" based, so that I can restrict the access to only for CIDR of load balancer.

Is there any other way to create the NLB load balancer with the IP based target type? Could you please help me with some suggestions?

apiVersion: v1
kind: Service
metadata:
  name: nginx-router
  annotations:
    service.beta.kubernetes.io/do-loadbalancer-protocol: "http"
    service.beta.kubernetes.io/do-loadbalancer-healthcheck-path: "/healthz"
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
    service.beta.kubernetes.io/aws-target-type: ip
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: [tes]

    # service.beta.kubernetes.io/healthcheck-path: /healthz
spec:
  selector:
    app: nginx-router
  externalTrafficPolicy: Local
  ports:
    - port: 80
      targetPort: 80
      protocol : TCP
      name : http
    - port : 443
      targetPort: 443
      protocol : TCP
      name : https

  type: LoadBalancer