3 ms·
> Out of the box it does not even bind to a public internet address. Bind to all interfaces used to be the default in 1.x - it changed pretty much because peop
by Xylakant 7y ago
> Out of the box it does not even bind to a public internet address.
Bind to all interfaces used to be the default in 1.x - it changed pretty much because people were footgunning themselves.
Coupled with lack of security in the base/free distribution, that made for a dangerous pitfall. At least now security is finally part of the free offering, but the OSS version still comes with no access control at all.
- lmilcin 7y agoYou typically use these in pods which share networking but are not available from outside. It doesn't matter then if you bind it to 0.0.0.0.
- dharmab 7y agoAt the time it was common to deploy on bare hosts. Deploying ES into a network namespace isn't even the most common use case today.
- Xylakant 7y agoThat still puts you a single firewall mistake away from disaster. It also places a lot of trust into the applications and hosts that can access ES on a network level: They get full access with no control at all. To add on that: No security also means no TLS, neither in the cluster communication, no TLS speaking to the client etc.