3 ms·
"Default access even with RBAC is too wide-open." Not following this. Isn't a k8s cluster behind a network firewall? Only exposing 443? To me RBAC would be us
by ransom1538 3y ago
"Default access even with RBAC is too wide-open."
Not following this. Isn't a k8s cluster behind a network firewall? Only exposing 443? To me RBAC would be useful in a specific case where you want k8 service accounts (no one uses these) to have different levels of security. That sounds awful.
- alephnerd 3y agoJeff in Engineering might have deployed an app spanning vCenter as well as EKS, and to continue to allow the app to function wrote subpar ingress/egress rules.
- mulmen 3y ago443 is just a port. If we assume that implies HTTPS then that’s still only TLS. If I exploit the service (“securely”!) I am inside your network. I can then pivot to your management layer. Game over.
- vbezhenar 3y ago> Isn't a k8s cluster behind a network firewall? Of course not, unless you configure it this way. > RBAC would be useful in a specific case where you want k8 service accounts (no one uses these) to have different levels of security. What? How comes no one uses service accounts? They're used extensively for many things.
- deleted 3y ago[deleted]