3 ms·

Equally important, we don't have network admins. It would be physically impossible to expose our search database like this to the open internet. Extra layers

Equally important, we don't have network admins. It would be physically impossible to expose our search database like this to the open internet. Extra layers of protection are great. It reminds me of companies I've worked with before that accidentally had a production site pointed to a dev database. Why the hell is that even physically possible with your network setup?

mschuster91 7y ago
Welcome to the wonderful world of Kubernetes (or, for that matter, any Docker orchestration solution, such as DC/OS). Anything can reach anything, provided you know the naming schema... and there's no easy way to fix it on anything that is not AWS/Azure/GCP, not without losing all the benefits of a self hosted k8s cluster in the first place. Openstack at least provides ways to isolate machines, but that's VM-level only and truly an ultimate PITA to set up.
- arpa 7y ago
  Not entirely true, there are network security policies (on select few CNI providers) and other means of segregation using good old iptables (although probably need to update alternatives for iptables to point to iptables-legacy for them to work).
  - mschuster91 7y ago
    Ew. iptables (or any other way of messing around with the black magic that Docker and the orchestrators do to provide intra-container networking) is one thing only and that is a nice way to shoot yourself in the head while aiming at your legs.
    - arpa 7y ago
      To be entirely honest, if you know what you're doing and how lets say kube-proxy works in essence, things get pretty easy and simple. If you start every configuration of firewall with iptables -F, you're gonna have an interesting time. However, if you spend some time around these beasts, they are pretty well and logically built and it is trivial to coexist and modify your chains without touching those managed by docker/k8s. There is no black magic/and or wrong with the way they manage the rules. I'm much more angry at proper iptables being moved to iptables-legacy and systemd messing around with my resolv.conf :)
mdavidn 7y ago
Amazon does provide a mechanism to define private networks disconnected from the internet. https://aws.amazon.com/vpc/ https://aws.amazon.com/vpc/

mschuster91 7y ago

Welcome to the wonderful world of Kubernetes (or, for that matter, any Docker orchestration solution, such as DC/OS). Anything can reach anything, provided you know the naming schema... and there's no easy way to fix it on anything that is not AWS/Azure/GCP, not without losing all the benefits of a self hosted k8s cluster in the first place. Openstack at least provides ways to isolate machines, but that's VM-level only and truly an ultimate PITA to set up.

arpa 7y ago
Not entirely true, there are network security policies (on select few CNI providers) and other means of segregation using good old iptables (although probably need to update alternatives for iptables to point to iptables-legacy for them to work).
- mschuster91 7y ago
  Ew. iptables (or any other way of messing around with the black magic that Docker and the orchestrators do to provide intra-container networking) is one thing only and that is a nice way to shoot yourself in the head while aiming at your legs.
  - arpa 7y ago
    To be entirely honest, if you know what you're doing and how lets say kube-proxy works in essence, things get pretty easy and simple. If you start every configuration of firewall with iptables -F, you're gonna have an interesting time. However, if you spend some time around these beasts, they are pretty well and logically built and it is trivial to coexist and modify your chains without touching those managed by docker/k8s. There is no black magic/and or wrong with the way they manage the rules. I'm much more angry at proper iptables being moved to iptables-legacy and systemd messing around with my resolv.conf :)

mdavidn 7y ago

Amazon does provide a mechanism to define private networks disconnected from the internet. https://aws.amazon.com/vpc/ https://aws.amazon.com/vpc/