NSA Kubernetes Hardening Guidance [pdf]

Re:NSA Kubernetes Hardening Guidance [pdf] by kelseyhightower on Tuesday August 03, 2021 @01:46PM (#28052004)

The one benefit you get is protection from bugs in Kubernetes itself and a reduced blast radius. Even if you could produce a secure and H/A cluster, you still leave yourself open to Kubernetes bugs and configuration mistakes such as adding a network policy that blocks all communication across all namespaces.

Multiple clusters protects you from these types of configuration mistakes by reducing the blast radius and providing an additional landing zone to roll out changes over time.

[ Parent | on HN ]

Re:NSA Kubernetes Hardening Guidance [pdf] by smarterclayton on Tuesday August 03, 2021 @01:58PM (#28052115)

And making it so that "many clusters" look exactly like "one cluster" is one of the goals the kcp prototype was exploring (although still early) because I hear this ALL the time:

1. 1 cluster was awesome

2. Many clusters means I rebuild the world

3. I wish there was a way to get the benefits of one cluster across multiples.

Which I believe is a solvable problem and partially what we've been poking at at https://github.com/kcp-dev/kcp (although it's still so early that I don't want to get hopes up).

[ Parent | on HN ]

Re:NSA Kubernetes Hardening Guidance [pdf] by dylan604 on Tuesday August 03, 2021 @02:04PM (#28052176)

If you have 2 clusters, wouldn't you just blue/green them for rolling changes?

[ Parent | on HN ]