Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Kubernetes clusters config checker tool

github.com

Post reply on HN
Print view View original

21–30 of 34 posts

Re: Google Kubernetes clusters config checker tool

#21

Post by _joel »

solatic wrote: post #14

https://github.com/google/gke-policy-automation/blob/main/gk... What's the point of requiring the control plane to be locked down to authorized networks (IP address ranges)? Isn't Google responsible for DDoS protection, enforcing authentication controls (i.e. logging in with a Google account in the right Google group), patching the control plane ASAP for any security vulnerabilities? If you have a VPN, if you have he…

Because you don't need to, plus you're covered against 0days. If you're creating infra on GCP then I'm sure it's not too much of an effort to use Google's osn Cloud VPN or create a bastion interface to ssh/wireguard into (only needs to be very small).

Re: Google Kubernetes clusters config checker tool

#22

Post by vbezhenar »

phailhaus wrote: post #16
pdimitar wrote: post #9

As many people predicted years ago (I can't claim to know k8s that well, in fact I suck at it), eventually we'll go full circle and k8s config will just become its own specialized programming language. Maybe we should stop moving these things so agonizingly slow and through the path of natural (and did I mention slow as molasses ) evolution and just skip to the endgame that most of us know will inevitably come? Appar…

There's no reason to create an entirely new language. Since k8s manifests can be represented in JSON, you can use existing templating languages like Jsonnet [1] in order to generate it for you. All we need is an official library. [1] https://jsonnet.org/

JSON is terrible to write by hand. YAML is terrible too. There should be an official and sane language which will map to YAML 1:1. We don't write Java code in YAML for a reason.

Re: Google Kubernetes clusters config checker tool

#23

Post by Ironlink »

no_circuit wrote: post #19
solatic wrote: post #14

https://github.com/google/gke-policy-automation/blob/main/gk... What's the point of requiring the control plane to be locked down to authorized networks (IP address ranges)? Isn't Google responsible for DDoS protection, enforcing authentication controls (i.e. logging in with a Google account in the right Google group), patching the control plane ASAP for any security vulnerabilities? If you have a VPN, if you have he…

Likely security in layers. Why expose your control plane to attacks directly from the internet if you don't have to? Cuts down login attempts noise in logs since anything would have to be coming from the VPC. Other than initial setup of a bastion -- that's the tradeoff -- sounds like less to worry about for a small shop or a startup. Same for Cloud SQL or any other managed service.

I wish they would reuse the pattern of Cloud SQL where you can get temporary access without manually handling the Authorized Networks setting. The Cloud SQL API lets you exchange your API access token for a short lived TLS client certificate. This is done client side by things like cloudsql-proxy[1] and the cloud-sql-jdbc-socket-factory java library[2]. This way, I can access my Cloud SQL instance from my IDE, even though my list of authorized networks is empty.

I feel like the gke-gcloud-auth-plugin cloud do something very similar.

[1]: https://github.com/GoogleCloudPlatform/cloudsql-proxy

[2]: https://github.com/GoogleCloudPlatform/cloud-sql-jdbc-socket...

Re: Google Kubernetes clusters config checker tool

#24

Post by mikowhy »

solatic wrote: post #14

https://github.com/google/gke-policy-automation/blob/main/gk... What's the point of requiring the control plane to be locked down to authorized networks (IP address ranges)? Isn't Google responsible for DDoS protection, enforcing authentication controls (i.e. logging in with a Google account in the right Google group), patching the control plane ASAP for any security vulnerabilities? If you have a VPN, if you have he…

The point is to limit the attack surface, following zero trust and least privilege principles. This particular rule follows also GKE product networking best practices [1]. However we understand that not all rules apply to all environments. That is why it is possible to exclude selected rules in a tool or provide set of own, custom policies. If Security Command Center is used, it is also possible to mute findings there.

References: [1] https://cloud.google.com/kubernetes-engine/docs/best-practic...

Re: Google Kubernetes clusters config checker tool

#25

Post by kyrra »

nova22033 wrote: post #7
rpadovani wrote: post #6

Given that is specific for GCP, and developed by somebody within Google, why not including it directly in the webconsole?

This is not an officially supported Google product. How does this work? It's developed by google but it's not officially supported?

(googler, opinions are my own).

Google actually publishes most of the docs that Googler's have to follow when open sourcing software. See:

https://opensource.google/documentation/reference/releasing

This specific line you're asking about is talked about here: https://opensource.google/documentation/reference/releasing/...

Re: Google Kubernetes clusters config checker tool

#26

Post by mikowhy »

nova22033 wrote: post #7
rpadovani wrote: post #6

Given that is specific for GCP, and developed by somebody within Google, why not including it directly in the webconsole?

This is not an officially supported Google product. How does this work? It's developed by google but it's not officially supported?

The tool is developed by Google Cloud engineers working in professional services. We create such tools to quickly help our customers (and often ourselves) in some particular challenges. Sometimes such initiatives are merging with a core product. The disclaimer is there to say, that this tool is maintained by the community, not the official product support.

Re: Google Kubernetes clusters config checker tool

#27

Post by mikowhy »

rpadovani wrote: post #6

Given that is specific for GCP, and developed by somebody within Google, why not including it directly in the webconsole?

That is good point but also long way ahead. Sometimes such tools are merging with a core product. The tool and policy was created by Google engineers that are not part of GKE product development teams.

For now I suggest to use the tool in a scheduled, serverless manner and configure evaluation output to Security Command Center. By that, processes will be fully automated and the results will be visible in a webconsole (as findings in Security Command Center).

Re: Google Kubernetes clusters config checker tool

#28

Post by jrockway »

vbezhenar wrote: post #22
phailhaus wrote: post #16

Earlier quoted context omitted.

There's no reason to create an entirely new language. Since k8s manifests can be represented in JSON, you can use existing templating languages like Jsonnet [1] in order to generate it for you. All we need is an official library. [1] https://jsonnet.org/

JSON is terrible to write by hand. YAML is terrible too. There should be an official and sane language which will map to YAML 1:1. We don't write Java code in YAML for a reason.

Jsonnet is the language that maps to YAML 1:1. The output happens to look like JSON, but JSON is a subset of YAML.

I've used Jsonnet for non-k8s stuff (envoy bootstrap configs), and it is really great. For example, this: https://github.com/pachyderm/pachyderm/blob/master/etc/gener... generates this: https://github.com/pachyderm/pachyderm/blob/master/etc/helm/...

Re: Google Kubernetes clusters config checker tool

#29

Post by zxspectrum1982 »

Red Hat has a similar tool called Red Hat Insights Advisor for OpenShift, which they provide as a free service with OpenShift subscriptions, so you don't need to install anything:

What is new in Insights Advisor for Red Hat OpenShift https://www.redhat.com/en/blog/what-new-insights-advisor-ope...

https://console.redhat.com/openshift/insights/advisor/recomm...

Re: Google Kubernetes clusters config checker tool

#30

Post by pid-1 »

solatic wrote: post #14

https://github.com/google/gke-policy-automation/blob/main/gk... What's the point of requiring the control plane to be locked down to authorized networks (IP address ranges)? Isn't Google responsible for DDoS protection, enforcing authentication controls (i.e. logging in with a Google account in the right Google group), patching the control plane ASAP for any security vulnerabilities? If you have a VPN, if you have he…

security = onion
Post reply on HN