3 ms·
Not entirely true, there are network security policies (on select few CNI providers) and other means of segregation using good old iptables (although probably n
by arpa 7y ago
Not entirely true, there are network security policies (on select few CNI providers) and other means of segregation using good old iptables (although probably need to update alternatives for iptables to point to iptables-legacy for them to work).
- mschuster91 7y agoEw. iptables (or any other way of messing around with the black magic that Docker and the orchestrators do to provide intra-container networking) is one thing only and that is a nice way to shoot yourself in the head while aiming at your legs.
- arpa 7y agoTo be entirely honest, if you know what you're doing and how lets say kube-proxy works in essence, things get pretty easy and simple. If you start every configuration of firewall with iptables -F, you're gonna have an interesting time. However, if you spend some time around these beasts, they are pretty well and logically built and it is trivial to coexist and modify your chains without touching those managed by docker/k8s. There is no black magic/and or wrong with the way they manage the rules. I'm much more angry at proper iptables being moved to iptables-legacy and systemd messing around with my resolv.conf :)