Re:NSA Kubernetes Hardening Guidance [pdf]
by throwaway984393 on Tuesday August 03, 2021 @06:35PM
(#28055075)
This would be less of a concern if the cluster's pods were Firecrackers, yes?
AWS EKS on Fargate has a dedicated ENI and kernel per pod; the only way to intercept the traffic is when it crosses a network, or with flow control logs. Or if somebody hacked the control plane, but that's always "Game over man, game over!"
AWS EKS on Fargate has a dedicated ENI and kernel per pod; the only way to intercept the traffic is when it crosses a network, or with flow control logs. Or if somebody hacked the control plane, but that's always "Game over man, game over!"