Why the hell is your Kubernetes API public?
leebriggs.co.uk
Why the hell is your Kubernetes API public?
1–10 of 45 posts
Re: Why the hell is your Kubernetes API public?
#2"...For reasons I can’t quite understand, we’ve sort of collectively decided that it’s okay to put our Kubernetes control planes on the public internet. At the very least, we’ve sort of decided it’s okay to give them a public IP address..."
Is that what Google does with Borg? ;-)
"...Many of the developers at Google working on Kubernetes were formerly developers on the Borg project. We've incorporated the best ideas from Borg in Kubernetes, and have tried to address some pain points that users identified with Borg over the years..." - https://kubernetes.io/blog/2015/04/borg-predecessor-to-kuber...
Re: Why the hell is your Kubernetes API public?
#3Kind of great that this is true! Speaks well that kube is generally pretty secure out of the box.
Being subject to denial of service is a risk though.
Re: Why the hell is your Kubernetes API public?
#4the solution they suggest is worse. they think a hipster vpn is authentication.
Re: Why the hell is your Kubernetes API public?
#5There is a very good paper [1] on attackers using open container and kubelet registries from colleagues of my uni advisor. Funnily enough, this was supposed to be my thesis‘ focus but they were faster. Happens to the best of us I guess :)
Re: Why the hell is your Kubernetes API public?
#6the solution they suggest is worse. they think a hipster vpn is authentication.
The tailscale k8s operator actually does auth as well as vpn.
Re: Why the hell is your Kubernetes API public?
#7It is public, so what? Obviously cloud operators consider it secure enough to offer that option by default. What are the reasons to consider it not secure?
Re: Why the hell is your Kubernetes API public?
#8Why people expose their core infrastructure on the internet directly and unfiltered always baffles me. I guess they must be SWEs who have never touched a server.
Re: Why the hell is your Kubernetes API public?
#9It is public, so what? Obviously cloud operators consider it secure enough to offer that option by default. What are the reasons to consider it not secure?
It's a good idea to minimize the attack surface you expose on the public Internet. Basically the default assumption should be to consider everything insecure. Cloud vendors by nature take ownership of protecting all their public facing APIs and they're in the business of offering and securing those. That doesn't mean you should open everything to the Internet.
Re: Why the hell is your Kubernetes API public?
#10the solution they suggest is worse. they think a hipster vpn is authentication.
Software-defined mesh networks are quite a bit more powerful than conventional VPNs, even if they often get used for the same purposes.