2 ms·
People are too worried about using k8s, containers and what not when they don't even know the basics of firewalls, setting basic permissions on their DBs, etc
by raverbashing 5y ago
People are too worried about using k8s, containers and what not when they don't even know the basics of firewalls, setting basic permissions on their DBs, etc
Default secure configs help a lot. But ensuring at least a basic auth system is present should be the duty of every developer/devops, etc.
- jeroenhd 5y agoI think development of easy distribution tools like Docker and K8s (well, easy once it's finally set up right…) make it a bit too easy for some developers to push stuff into production. These tools allow you to avoid the basics and go straight from local dev to production with just a few lines of YAML and a (probably pre-built) pipeline from somewhere. That's great if you're taking into account standard security configuration because you can deploy new tools instantaneously, but it's terrible if you've never thought about firewalls and ACLs before. In a world where the solution to dependency management is "ship an entire Linux install", it's become too easy to mess up. If you don't understand exactly what your magic "just make it work" tools actually do and how they modify your system configuration, you shouldn't use them to run stuff in production.