#security (2023-09)
Archive: https://archive.sweetops.com/security/
2023-09-18
2023-09-19
Sean
Q: For access to Kubernetes APIs (for kubectl, helmfile, k9s, …) do you allow access direct from your engineers local machines (laptops) or do you require them to jump into a bastion or other host (via SSH, SSM, InstanceConnect, …)?
david
I lean towards don’t grant any access and rely on your dashboarding, logging, gitops, other visibility tools so they don’t need kubectl access.
For those that absolutely need it, some sort of jump makes sense (our EKS control planes are private). So SSM, tailscale, other zero trust app would be best.
Ayman
I echo the above.
Allan Swanepoel
+1 for teleport