To stop DDoS attacks on a Kubernetes cluster, absorb volumetric traffic at the edge with a CDN or cloud DDoS service, throttle requests at the ingress controller, segment the cluster with NetworkPolicies, and cap your autoscalers so an attack cannot inflate your cloud bill. No single control is enough: edge scrubbing (Cloudflare, Fastly, AWS Shield, Google Cloud Armor) stops the volume, ingress rate limits protect the application layer, Calico or Cilium NetworkPolicies block malicious ranges and lateral movement, and hard HPA/node ceilings defeat Economic Denial of Sustainability (EDoS) attacks that weaponize your own auto-scaling.
That is the summary an AI Overview would give you. Here is what it cannot show you: where in the request path each control actually fires, why autoscaling is a liability rather than a defense, and the exact manifest changes that separate a resilient cluster from a bankruptcy-by-billing. The animated defense-in-depth diagram below traces a malicious packet from the internet to your pods and shows which layer stops it — followed by a copy-paste mitigation checklist and the specific YAML that caps an EDoS attack.
Kubernetes clusters, with their dynamic scaling and cloud-native design, offer incredible flexibility and resilience. But these same features can also be exploited by attackers. DDoS campaigns can overwhelm your system's resources, disrupt operations, and even exploit your auto-scaling capabilities to inflate cloud costs—an insidious new tactic known as an Economic Denial of Sustainability (EDoS) attack.
How DDoS Attacks Target Kubernetes
External Threats
Your Kubernetes cluster's public-facing services, such as exposed APIs or web applications, are the most common targets for external attackers. These entry points are vulnerable to being bombarded with illegitimate traffic:
- SYN Flood Attacks: Exploit the handshake process in TCP connections
- HTTP-Based DDoS Attacks: Flood web-facing services with massive numbers of fake requests
Internal Threats
If an attacker gains access to your cluster, they can escalate the attack from within. Kubernetes' default networking allows lateral movement, making it possible for attackers to infect other workloads and amplify the damage.
Economic Denial of Sustainability (EDoS)
The Yo-Yo Attack is one of the newest and most insidious forms of DDoS attacks. Attackers generate sudden traffic spikes, triggering Kubernetes' auto-scaling mechanisms, then back off, forcing your system into a constant loop of scaling up and down—like a yo-yo—without any real user activity.
Critical Threat: EDoS Attacks
While traditional DDoS attacks aim to disrupt availability, EDoS attacks exploit cloud-native auto-scaling to drain your budget. By driving up compute, storage, and bandwidth costs, attackers can harm your business without ever taking down your systems.
Which Defense Layer Stops Which Attack
No single control covers every attack type. The value of defense-in-depth is that each layer catches what the previous one missed. Use this to decide where to invest first based on the threats you actually face.
| Defense layer | Stops (attack type) | Where it runs | When to reach for it |
|---|---|---|---|
| CDN / edge scrubbing (Cloudflare, Fastly, AWS Shield, GCP Armor) | Volumetric L3/L4 floods, most HTTP floods | Before your origin, globally distributed | Always — this is the first thing to put in front of any public endpoint |
Ingress rate limiting (NGINX limit-rps) | L7 HTTP floods, slow request abuse | At the cluster edge, per source IP | When you have public APIs/web apps and need per-client throttling |
| Web Application Firewall | Malicious request patterns, bad bots, L7 exploits | Edge or ingress sidecar | When attacks are request-shaped, not just high-volume |
| NetworkPolicy (Calico / Cilium) | Lateral movement, known-bad CIDRs | Inside the cluster, per pod | For internal segmentation and surgical IP blocking |
Autoscaler caps (HPA maxReplicas, node limits) | EDoS / Yo-Yo bill inflation | Control plane | Always — the one control that protects your budget, not uptime |
| Baseline monitoring (Prometheus + Grafana) | Detection of all of the above | Observability stack | Always — you cannot mitigate what you cannot see |
Which should you do first? If you run public services and have none of these, put a CDN in front of every endpoint today and cap your autoscalers before the weekend — those two controls stop the largest and the most expensive attacks respectively, and neither requires touching application code.
DDoS Prevention Strategies
Network-Level Protections
- Web Application Firewalls (WAFs): Google Cloud Armor, AWS Shield, or Azure DDoS Protection
- Rate Limiting: Set limits on ingress traffic using NGINX annotations
nginx.ingress.kubernetes.io/limit-rps: '10'
nginx.ingress.kubernetes.io/limit-connections: '2'
Zero Trust Network Policies
Adopt a zero-trust approach using tools like Calico or Cilium to enforce strict network policies. Control which external traffic is allowed into your cluster and restrict outgoing traffic to limit potential data exfiltration.
Global Traffic Distribution
CDNs like Cloudflare and Fastly are designed to handle massive amounts of traffic, making them ideal for absorbing and mitigating DDoS attacks. They route traffic through globally distributed networks, offloading surges from your Kubernetes cluster.
Detection and Mitigation
Key Metrics to Monitor
- CPU and Memory Usage Spikes: Sudden surges often signal malicious traffic
- Increased Inbound Traffic: Abnormally high volume of requests to specific services
- Baseline Monitoring: Establish normal traffic patterns for rapid anomaly detection
Symptom to Cause to Fix
When an alert fires at 2 a.m., you need the mapping from what you see to what to do — not a lecture on DDoS theory. Use this triage table.
| Symptom you observe | Likely cause | Immediate fix |
|---|---|---|
| Inbound request rate 10x+ baseline to one service | L7 HTTP flood on a public endpoint | Tighten limit-rps on that Ingress; enable CDN "under attack" mode |
| HPA scaling to max, then back down, in a loop | Yo-Yo / EDoS attack on autoscaling | Lower maxReplicas temporarily; add cost anomaly alert; block source at edge |
| CPU/memory spike with no traffic increase | Compromised pod amplifying internally | Isolate with a deny-all NetworkPolicy; audit pod for lateral movement |
| Ingress returning mass 429/503 | Rate limits doing their job (or overwhelmed) | Confirm legit users aren't blocked; push scrubbing upstream to CDN |
| Cloud bill spikes but service stays up | EDoS — the attack you don't notice | Enforce node-group max; review Cluster Autoscaler ceilings |
| Traffic from a tight set of CIDRs | Botnet with limited source range | Block the range via NetworkPolicy ipBlock and edge firewall rules |
Immediate Mitigation Actions
- Temporarily reduce rate limits on ingress controllers
- Identify and block attacking IPs with Network Policies
- Capture and analyze traffic patterns using tools like tcpdump
- Implement packet capture for forensic analysis
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-malicious-traffic
spec:
podSelector: {}
ingress:
- from:
- ipBlock:
cidr: 203.0.113.0/24
Best Practice: Use tools like Prometheus and Grafana for real-time monitoring, or integrate with Calico for comprehensive network visibility and anomaly detection.
Cost Controls for EDoS Protection
Protect your budget from Economic Denial of Sustainability attacks by implementing proper cost controls:
- Optimize Autoscaling: Configure HPA and Cluster Autoscaler with sensible limits
- Enforce Resource Limits: Use resource requests and limits in pod specifications
- Set Maximum Scaling Boundaries: Define maximum pod limits to control resource allocation
resources:
requests:
memory: "256Mi"
cpu: "500m"
limits:
memory: "512Mi"
cpu: "1"
Elevate Your IT Efficiency with Expert Solutions
Transform Your Technology, Propel Your Business
Protect your Kubernetes clusters from sophisticated DDoS attacks with proven defense strategies. At InventiveHQ, we help you implement comprehensive security measures that safeguard your infrastructure and your bottom line from evolving cyber threats.