kubernetes-guides

kubernetes-guides copied to clipboard

Networking and security infrastructure like (in the case of AWS) VPCs and SecurityGroups have significant security implications in their setup, and the blast radius of changes to this plane are very high. We should split these into their own stacks, instead of provisioning them along with databases and compute.

Our current plan for each of the clouds, roughly, is to have an architecture with:

• A subnet with a small set of publicly-available hosts (e.g., bastion hosts)
• A subnet with a larger set of hosts which can only be reached from the publicly-available hosts
• A subnet with the managed data services (e.g., RDS) which can only be reached from the managed compute subnet.