This article is working backwards to solving a problem that most development teams shouldn't have. I will first walk along with the article and try out their ba

This article is working backwards to solving a problem that most development teams shouldn't have. I will first walk along with the article and try out their backwards solution before getting to my point: If you're using Kubernetes managed by a cloud provider, e.g., Amazon EKS, authentication is already handled through IAM. This is a service that's designed to be exposed to Internet traffic and that AWS is essentially managing for you. If you're able to get past AWS IAM then the fact that your cluster API is public is moot because gaining access to an AWS account that has significant kubectl privileges is likely going to also expose a number of other privileges to make changes in AWS. Okay, perhaps that's not enough for your liking. We want more defense in depth. AWS already tells us how to use a private API endpoint via their documentation: https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html#private-access https://docs.aws.amazon.com/eks/latest/userguide/cluster-end... But of course, those suggestions bring us here to this article: Amazon suggests using a bastion or a cloud IDE, but we might find that too clunky. This is where the article offers "a better alternative: Tailscale is basically one of those fancy easy-to-use VPN replacements that promises to get rid of VPNs and bastion hosts in favor of protocol-aware proxying. And, that's fine, but it's not cheap compared to a traditional open source VPN if you're using it for a company: https://tailscale.com/pricing https://tailscale.com/pricing Besides not being very cost-effective, we're still working backwards to the actual issue here. Who needs kubectl access and why are they using it so much in production that a bastion or VPN is annoying? Why don't we just make it so that developers don't have to use kubectl in production anymore? Isn't their code being deployed with an automated pipeline?