undefined | Better HN

0 pointsyongjik5y ago0 comments

Of course everyone's experience is different, but in my case...

> How do you view all the VMs in a project across the globe at the same time?

I'm not sure what it's got to do with k8s? I can't see jobs that belong to different k8s clusters at the same time, either.

> Do you need to manage keys when ssh'n into a VM?

Well, in k8s everybody who has access to the cluster can "ssh" into each pod as root and do whatever they want, or at least that's how I've seen it, but I'm not sure it's an improvement.

> Do you know what the purpose of all the products are? If you don't know one, are you able to at least have an idea what it's for without going to documentation?

Man, if I got a dime every time someone asked "Does anyone know who owns this kubernetes job?", I'll have... hmm maybe a dollar or two...

Of course k8s can be properly managed, but IMHO, whether it is properly managed is orthogonal to whether it's k8s or vanilla AWS.

0 comments

kronin5y ago

If you're running pods as root, you're doing it wrong. That was a no-no with docker, and it's still a no-no for kubernetes. People still run non-containerized services as root too...

yongjikOP5y ago

This is getting off-topic, but I didn't understand the rationale behind that. Processes running inside docker/k8s are already isolated, so unless you're running something potentially malicious, why would it matter if it's root or not?

(Of course, if you're running untrusted user code, then you'll need every protection you can muster, but I'm talking about running an internally developed application. If you can't trust that, you already have a bigger problem.)

kronin5y ago

If the container is running as root, and you escape the container, you are root on the host.

Containers share the kernel with the host, and are only as isolated as the uid the process in the container runs as and the privileges you grant that container.

1 more reply

collyw5y ago

Docker won't run on my local machine as non root. And all the stuff I have seen so far has been run as root.

arejaytee5y ago

Beleive they were referring to AWS not k8

j / k navigate · click thread line to collapse

0 pointsyongjik5y ago0 comments

Of course everyone's experience is different, but in my case...

> How do you view all the VMs in a project across the globe at the same time?

I'm not sure what it's got to do with k8s? I can't see jobs that belong to different k8s clusters at the same time, either.

> Do you need to manage keys when ssh'n into a VM?

Well, in k8s everybody who has access to the cluster can "ssh" into each pod as root and do whatever they want, or at least that's how I've seen it, but I'm not sure it's an improvement.

> Do you know what the purpose of all the products are? If you don't know one, are you able to at least have an idea what it's for without going to documentation?

Man, if I got a dime every time someone asked "Does anyone know who owns this kubernetes job?", I'll have... hmm maybe a dollar or two...

Of course k8s can be properly managed, but IMHO, whether it is properly managed is orthogonal to whether it's k8s or vanilla AWS.

0 comments

kronin5y ago

If you're running pods as root, you're doing it wrong. That was a no-no with docker, and it's still a no-no for kubernetes. People still run non-containerized services as root too...

yongjikOP5y ago

kronin5y ago

If the container is running as root, and you escape the container, you are root on the host.

Containers share the kernel with the host, and are only as isolated as the uid the process in the container runs as and the privileges you grant that container.

1 more reply

collyw5y ago

Docker won't run on my local machine as non root. And all the stuff I have seen so far has been run as root.

arejaytee5y ago

Beleive they were referring to AWS not k8

j / k navigate · click thread line to collapse