Hacker News Reader

443 is just a port. If we assume that implies HTTPS then that’s still only TLS. If I exploit the service (“securely”!) I am inside your network. I can then pivot to your management layer. Game over.

Jeff in Engineering might have deployed an app spanning vCenter as well as EKS, and to continue to allow the app to function wrote subpar ingress/egress rules.

> Isn't a k8s cluster behind a network firewall?

Of course not, unless you configure it this way.

> RBAC would be useful in a specific case where you want k8 service accounts (no one uses these) to have different levels of security.

What? How comes no one uses service accounts? They're used extensively for many things.