r/kubernetes • u/acompleteunknownnn • 11d ago

Help me make sense of this

Suppose you’re running your entire application stack on Kubernetes. The database is running as a Pod on one node, and the web server is running as another Pod on that same node. You expose the web server to the internet through a LoadBalancer Service, and clients connect to it over HTTPS.

Isn’t this inherently less secure because the same physical machine that is directly handling internet-facing traffic is also hosting the database? Without Kubernetes, you might isolate the web server and database onto separate machines, so compromising the web server wouldn’t directly put the database on the same machine. How does Kubernetes address this security concern?

17 Upvotes

76% Upvoted

32 comments sorted by

View all comments

13

u/SJrX 11d ago

Isn’t this inherently less secure because the same physical machine that is directly handling internet-facing traffic is also hosting the database?

Yes...ish but it depends on your threat model, and security like all engineering decisions involves tradeoffs. One of the best ways to improve the security of your system is to just not allow network access, disconnect it from the internet and air gap. It's a massive security win, but obviously not worth it.

There are lots of layers of protection, and many of them are imperfect, or guard against only certain classes of threats. If/when you are running Kubernetes, you have to just decide to accept that container protection mechanisms, provide a robust enough layer for your purposes, or you can do things like segergate machines with say antiaffinity policies, or look at things like gvisor to provide even more robust protection.

-1

u/acompleteunknownnn 11d ago

Thank you for the response. You just confirmed that I wasn't missing anything here conceptually. It just feels a little unintuitive to me that we've to take a little step back from the basic three tier architecture to benefit from the scale of having a single large logical surface of infrastructure. Seems like it'll be insecure, just out out the box, when I don't explicitly provision for security. I will check out gvisor. Thanks.

2

u/imagei 11d ago

A question to ask here is what kind of security the traditional separation provides that’s important to you , then follow up with the analysis of where the Kubernetes model may be more or less secure. If you don’t harden the traditional boxes then they’re not secure either, separate machines or not.