News for hackers. Stuff that matters.
Re:NSA Kubernetes Hardening Guidance [pdf] by antonvs on Tuesday August 03, 2021 @01:56PM (#28052094)
At a high level, almost anything you would want to use multiple clusters for can be done on a single cluster, using e.g. node pools, affinity, and taints to ensure that workloads only run on the machines you want them to. As a simple example, you can set up a separate node pool for production, and use node affinity and/or taints to ensure that only production workloads can run there.

One exception, as other have mentioned, is blast radius - with a single cluster, a problem with Kubernetes itself could take down everything.

Re:NSA Kubernetes Hardening Guidance [pdf] by dharmab on Tuesday August 03, 2021 @01:58PM (#28052112)
Another issue is scaling limits. We've found a few dozen ways to break a cluster by scaling along a certain axis. (Most are not related to "vanilla" Kubernetes but the backing cloud provider or specific add-on components.)
Re:NSA Kubernetes Hardening Guidance [pdf] by allset_ on Tuesday August 03, 2021 @11:21PM (#28056840)
Other management tasks are easier when you have separate clusters, such as applying environment-specific OPA policies and not having to filter them based on labels or annotations you hope everyone is using correctly.