2 ms·

> Kubernetes does not create complexity Aaaaaahahhaahhahaha.... .....wait you were serious? Just one example off the top of my head: ClusterRole vs Role. Two

> Kubernetes does not create complexity Aaaaaahahhaahhahaha.... .....wait you were serious? Just one example off the top of my head: ClusterRole vs Role. Two kinds of role. Difference? One applies to a namespace, the other applies to all namespaces, cluster resources, and non-resources. Why not just make "Role" deal with all of them based on metadata or annotations? Because fuck it, that's why. Oh, and permissions cannot include a "deny" section, they can only "allow". Why? Fuck it, that's why. You can create a secret, but only in one namespace, and there's no way to automatically share it with multiple namespaces. Why? Fuck it, that's why. K8s is a shitshow of both complexity and a lack of functionality. It's a design-by-committee atrocity that is so bad it created an entire ecosystem to fill in all the bullshit it doesn't do.

uberduper 3y ago
Because namespaces are security boundaries? Don't tell me you make a namespace for each and every application or service.
- raesene9 3y ago
  Worth noting that, on their own, namespaces are not security boundaries, they're (IMO) primarily intended to be organizational constructs. What namespaces do allow for, from a security perspective, is for various controls (e.g. RBAC, Network Policy, Pod Security Admission) to be applied to a given application or group of applications (depending on how you've organized your namespaces) in a relatively controlled fashion.