Cristian Klein
Cristian Klein
Hi @davidumea. Thanks for bringing this up. I would recommend *against* enabling WireGuard by default. Why? 1. The security benefits are unclear. We do regular [provider audits](https://elastisys.io/compliantkubernetes/operator-manual/provider-audit/) on the providers...
@llarsson Thanks for pointing that out! I get the feeling that NSA's Kubernetes Hardening Guide, Page 20 insists on **control plane traffic encryption**, which is on by default (can one...
We just bumped into this with a project. Seems like WireGuard needs a smaller MTU to make room for the extra headers. This definitely has some performance implications:  Source:...
@OlleLarsson Some of the ideas in [ck8s-cluster ](https://github.com/elastisys/ck8s-cluster) and [ck8s-base-vm](https://github.com/elastisys/ck8s-base-vm) are definitely worth bringing back. However, let us this time stay closer to upstream and put ourselves in a better...
@llarsson Just to write-up my thoughts, at this point I'm unsure whether Kubespray is going to be the future. Hence, your question "how long time does a run of Kubespray...
An earlier version of this issue also requested for improving the non-OpenID KUBECONFIG generated by Kubespray to facilitate its usage from the local machine (i.e., proper contexts, proper usernames, proper...
I quickly checked [kubeconfig.bash](https://github.com/elastisys/compliantkubernetes-apps/blob/main/bin/kubeconfig.bash). I feel that the way we create OpenID-enabled KUBECONFIGs is rather specific to Compliant Kubernetes and not very upstreamable. Let's close this for now.
This should be unnecessary once [ADR 0006 "Use Standard Kubeconfig Mechanisms"](https://github.com/elastisys/compliantkubernetes/blob/adr-kube-context/docs/adr/0006-use-standard-kubeconfig-mechanisms.md) is approved and implemented.
> I would be nice to know the reasoning behind the `apply-ssh` command. If I was going to update SSH keys on the hosts I would use the already existing...
The current state-of-practice seems to be that NetworkPolicies belong to the Helm Chart of the application they protect, with the `values.yaml` file specifying which inbound traffic is allowed. For inspiration,...