- Straightforward upgrades of the environment to incorporate security patches
- Straightforward deploys
- Straightforward recreation of the setup (sort of like what terraform gets you)
- Straightforward migration to another hosted k8s shop if the savings are attractive
- I don't have to configure HAProxy, logging, systemd, etc.
- Straightforward horizontal scaling
How do you ensure that your exposed containers have all the relevant security patches, especially if the images aren't uniform? Are you using something like Watchtower to monitor for vulnerable packages and automatically rebuild and redeploy the containers when e.g. the underlying Ubuntu or Alpine image uses a vulnerable library?
Lots of people have the mistaken impression that containerization inherently protects their application from running vulnerable code. If you already have this built in to your pipeline, I'll be impressed!