mikowhy

The K8S operator that leverages (still alpha) feature of Kubernetes to decrease cold start times for CPU hungry workloads

That is good point but also long way ahead. Sometimes such tools are merging with a core product. The tool and policy was created by Google engineers that are not part of GKE product development teams.

For now I suggest to use the tool in a scheduled, serverless manner and configure evaluation output to Security Command Center. By that, processes will be fully automated and the results will be visible in a webconsole (as findings in Security Command Center).

The tool is developed by Google Cloud engineers working in professional services. We create such tools to quickly help our customers (and often ourselves) in some particular challenges. Sometimes such initiatives are merging with a core product. The disclaimer is there to say, that this tool is maintained by the community, not the official product support.

The point is to limit the attack surface, following zero trust and least privilege principles. This particular rule follows also GKE product networking best practices [1]. However we understand that not all rules apply to all environments. That is why it is possible to exclude selected rules in a tool or provide set of own, custom policies. If Security Command Center is used, it is also possible to mute findings there.

References: [1] https://cloud.google.com/kubernetes-engine/docs/best-practic...

they put all the best to k9s: ncurses style of UI + vi style of key bindings

Our focus is on Google Cloud and Google Kubernetes Engine specifics but I love Popeye and K9S from derailed!