Google Kubernetes clusters config checker tool • Hacker News Board

Re: Google Kubernetes clusters config checker tool

#31

Post by solatic » Tue, Jul 26, 2022, 4:00 AM UTC

no_circuit wrote: post #19

solatic wrote: post #14

https://github.com/google/gke-policy-automation/blob/main/gk... What's the point of requiring the control plane to be locked down to authorized networks (IP address ranges)? Isn't Google responsible for DDoS protection, enforcing authentication controls (i.e. logging in with a Google account in the right Google group), patching the control plane ASAP for any security vulnerabilities? If you have a VPN, if you have he…

Likely security in layers. Why expose your control plane to attacks directly from the internet if you don't have to? Cuts down login attempts noise in logs since anything would have to be coming from the VPC. Other than initial setup of a bastion -- that's the tradeoff -- sounds like less to worry about for a small shop or a startup. Same for Cloud SQL or any other managed service.

But setting up a bastion has its own issues. Now I need to monitor and patch it regularly, which with a 100% Kubernetes shop means I need a completely separate setup for it. How do I protect my bastion against DDoS?

Managed VPN services have their own costs and worries. Don't want to accidentally pay for tunneled Netflix or YouTube? More configuration and maintenance.

What kind of attacks from the Internet need to be worried about here? Basically just zero-days? But that's true for any bastion or VPN as well, and again, Google is managing the control plane so they're empowered to roll out the patch faster than a small customer could.

Re: Google Kubernetes clusters config checker tool

#32

Post by bboreham » Tue, Jul 26, 2022, 5:05 AM UTC

ninkendo wrote: post #17

phailhaus wrote: post #16

Earlier quoted context omitted.

There's no reason to create an entirely new language. Since k8s manifests can be represented in JSON, you can use existing templating languages like Jsonnet [1] in order to generate it for you. All we need is an official library. [1] https://jsonnet.org/

There was a tool called ksonnet for this (jsonnet + a default library for k8s configs), but the company behind it got bought and it's no longer maintained: https://github.com/ksonnet/ksonnet

A spiritual / practical successor is Tanka http://tanka.dev

(Note I work for Grafana Labs who fund Tanka and use it for all production config)

Re: Google Kubernetes clusters config checker tool

#33

Post by no_circuit » Wed, Jul 27, 2022, 3:59 PM UTC

solatic wrote: post #31

no_circuit wrote: post #19

Earlier quoted context omitted.

Likely security in layers. Why expose your control plane to attacks directly from the internet if you don't have to? Cuts down login attempts noise in logs since anything would have to be coming from the VPC. Other than initial setup of a bastion -- that's the tradeoff -- sounds like less to worry about for a small shop or a startup. Same for Cloud SQL or any other managed service.

But setting up a bastion has its own issues. Now I need to monitor and patch it regularly, which with a 100% Kubernetes shop means I need a completely separate setup for it. How do I protect my bastion against DDoS? Managed VPN services have their own costs and worries. Don't want to accidentally pay for tunneled Netflix or YouTube? More configuration and maintenance. What kind of attacks from the Internet need to be…

You probably already have CI/CD so a scheduled action on something like running Terraform would notice that your VM OS image version just got updated and automatically replace your bastion. That image seems to update every few days. You don't lose any data since persistent disk(s) are attached. I'd be surprised if anyone with automation still manually logs into machines to run apt-get update and upgrade -- cloud-init and/or crontab should do that for you.

If there aren't any DNS entries pointing to my bastion host(s), then I'd find it unlikely that a DDoS would ever specifically be directed to them. Pretty easy to recreate them in another region, and/or put them behind something like Cloudflare.

Re: Google Kubernetes clusters config checker tool

#34

Post by sg1234 » Thu, Jul 28, 2022, 4:07 PM UTC

solatic wrote: post #14

https://github.com/google/gke-policy-automation/blob/main/gk... What's the point of requiring the control plane to be locked down to authorized networks (IP address ranges)? Isn't Google responsible for DDoS protection, enforcing authentication controls (i.e. logging in with a Google account in the right Google group), patching the control plane ASAP for any security vulnerabilities? If you have a VPN, if you have he…

Would you feel more comfortable if you had an in cluster agent that dial into a Google Managed API and receives command from it ? This way your control plane can be private and you don't have to handle Managed Authorize Networks.