Securing components

[piraeusdatastore]

Securing components

[WanzenBug]

I assume you already had a look at the security guide? If not please take a look. The current state is not ideal, as it requires a lot of manual work. We are thinking about adding support for some of the many automatic certificate management tools in Kubernetes, like cert-manager in the future. This should make the whole process a lot easier.

There is a risk ofsomeone targeting your machines and trying to extract the content of your volumes. If someone can spoof one of your servers, they can effectively intercept all control and sync traffic between your servers.

If you are running Kubernetes on servers in public network, I would recommend to enable encryption of your pod network. I think most of the network providers support some kind of encryption for the pod network. This would then also include the control-plane traffic of Piraeus.

[vitobotta]

So if I use Weave CNI with encryption enabled, is my setup secure? Thanks!

[WanzenBug]

That would encrypt all communication between your pods. That still leaves the possibility to read the traffic of DRBD. If possible, I would create a wireguard tunnel between your virtual servers. That way you can ensure that all traffic not just between Pods is secure.

[vitobotta]

Gotcha, thanks!

[WanzenBug]

Securing the control plane got a lot easier since merging #263