CODEWITHSUNDEEP
kuberneteskubernetes-security
Bro
Bro

Reputation: 589

Kubernetes over internet

My VPS provider doesn't have possibility to have private network between VSes. So master and nodes are interconnected over the internet. Is it safe enough practice? Or it is better to move to AWS?

Upvotes: 5

Views: 3949

Answers (1)

Radek 'Goblin' Pieczonka
Radek 'Goblin' Pieczonka

Reputation: 22874

While the other answer states it is not safe I would strongly disagree on it.

1: It is perfectly fine to expose master on the public internet, as you would do with any other server. It is by design protected with authentication/cipher. Obviously a regular sec hardening should be in place, but that is a case for any internet facing system. Your masters will also run things like scheduler and controller-manager, all locally, so not really an issue.

2: The traffic between pods in usual kubernetes setup passes via an overlay network like ie. flannel, calico or weave. Speaking from experience, some of them, like in my case Weave Net, support traffic ciphering explicitly to make it safer for the overlay to communicate over public network.

3: Statement that any pods that open ports are by default public is fundamentally wrong. Each pod has it's own network namespace, so even if it listens on 0.0.0.0 to capture any traffic, this happens only within that local namespace so by no means is it exposed externally. Untill you configura kubernetes service of NodePort or LoadBalancer type to explicitly expose this service (and it's backing pods ports) to the internet. And you can control this even more by means of NetworkPolicies.

So yes, you can run kubernetes cluster over public network in a way that is safe.

Upvotes: 11

Related Questions