compliantkubernetes
compliantkubernetes copied to clipboard
Update page for in-cluster network communication
Describe the bug
We should update this page (?) with information about a list of weaknesses such as the cross-namespace forwarding exploit.
Screenshots
Additional context
@cristiklein please add more as I didn't quite catch what more we wanted to add to the page 😅
@OlleLarsson A few more details:
Currently, the Network Model page condenses too many networking topics. I'm listing them from "inside to outside":
- How does Pod-to-Pod communication work inside the Workload Cluster?
- How to enforce network separation via NetworkPolicies?
- How does Service Discovery (i.e., DNS via Kubernetes Services) work inside the Workload Cluster?
- How to expose Pods outside the Workload Cluster (Ingress)?
- How to configure DNS when exposing Pods outside?
- How to add rate-limiting to Ingresses?
- How to add TLS encryption to Ingresses?
I believe that Application Developers would benefit from separating these topics on at least two pages. I propose 1-3 "inside" and 4-7 "outside".
The cross-namespace exploit topic fits perfectly in 2.