Private endpoints

Okteto allows you to restrict access to your application by marking its endpoints as private. Private endpoints can only be accessed by Okteto users who have access to your Okteto namespace, and they'll need to provide their credentials before being granted access.

Deprecated in Self-Hosted

Private Endpoints are deprecated in Self-Hosted installations and not supported with Gateway API. See Private Endpoints in the Gateway API migration guide for the alternative. Private Endpoints are not deprecated in Bring Your Own Cloud (BYOC), where they work with Ingress objects and HTTPRoutes.

Private endpoints can be identified by the lock icon in the Okteto dashboard:

Enable Private Endpoints for your Application

HTTPRoute

In BYOC, add the dev.okteto.com/private: "true" annotation to your own HTTPRoutes:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: hello-world
  annotations:
    dev.okteto.com/private: "true"
spec:
  rules:
    - backendRefs:
        - name: hello-world
          port: 8080

Docker Compose

Private Endpoints is one of the extensions that Okteto added to Docker Compose to make it easier to develop cloud-native applications.

You can enable private endpoints by adding the dev.okteto.com/private: "true" label to your service:

name: hello-world
services:
  hello-world:
    labels:
      dev.okteto.com/private: "true"
    image: nginx
    ports:
      - 8080:8080

You can also define this at the endpoint level if needed.

name: hello-world
endpoints:
  annotations:
    dev.okteto.com/private: "true"
  rules:
    - path: /
      service: hello-world
      port: 8080
services:
  hello-world:
    image: nginx
    expose:
      - 8080

Ingress

Add the dev.okteto.com/private: "true" annotation to your own Ingress objects:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: hello-world
  annotations:
    dev.okteto.com/private: "true"
spec:
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: hello-world
                port:
                  number: 8080

Service

Add the dev.okteto.com/auto-ingress: "private" annotation to your Service, and Okteto creates a private endpoint for it:

apiVersion: v1
kind: Service
metadata:
  name: hello-world
  labels:
    app: hello-world
  annotations:
    dev.okteto.com/auto-ingress: "private"
spec:
  type: ClusterIP
  ports:
    - port: 8080
      protocol: TCP
      targetPort: 8080
  selector:
    app: hello-world

Private Endpoints generated this way follow the same rules and restrictions as other Endpoints.

If you only want to protect certain endpoints of your application, such as the admin portal or your metrics endpoint, create two HTTPRoutes or Ingress objects:

• A first one with the routes for all the public endpoints.
• A second one, with the dev.okteto.com/private annotation, for all your private routes.

Restrictions

Private Endpoints use your Okteto account for authentication, so they're best suited to protect endpoints that you and your team will access via the browser. They're not recommended for automation, or to protect endpoints that will be accessed by your end users.

Private Endpoints only restrict external access to your applications. Applications running in your namespace will be able to access your private endpoints without authentication by using the service name.