From 4a22dda13fe324c478cb12ab187f0ed80b62d65e Mon Sep 17 00:00:00 2001 From: Vladimir Pouzanov Date: Tue, 6 Nov 2018 17:25:53 +0000 Subject: [PATCH 1/2] Add a note on how to secure the configuration. --- site/kubernetes/kube-addon.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 56889e12..9a7b7133 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -33,6 +33,8 @@ with a single command: $ kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')" ``` +**Important:** this configuration won't enable encryption and might be unfit for production use depending on your circumstances. Read on to see the alteranatives. + After a few seconds, a Weave Net pod should be running on each Node and any further pods you create will be automatically attached to the Weave network. @@ -442,3 +444,7 @@ For example, - name: IPALLOC_RANGE value: 10.0.0.0/16 ``` + +## Securing the Setup + +You must pass the `password-secret` option as noted in the previous section to enable the data plane encryption; this is a recommended option in case you cannot be sure about the security of the fabric between your nodes. Read on the [Securing Connections Across Untrusted Networks](/site/tasks/manage/security-untrusted-networks/) document to see the alternatives. From 1c81fcb6935c870912038652725b31d86156a157 Mon Sep 17 00:00:00 2001 From: Vladimir Pouzanov Date: Mon, 12 Nov 2018 14:38:25 +0000 Subject: [PATCH 2/2] Change the wording in the header, add `trusted-subnets` note --- site/kubernetes/kube-addon.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 9a7b7133..8db3dccd 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -33,7 +33,7 @@ with a single command: $ kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')" ``` -**Important:** this configuration won't enable encryption and might be unfit for production use depending on your circumstances. Read on to see the alteranatives. +**Important:** this configuration won't enable encryption by default. If your data plane traffic isn't secured that will allow malicios actors to access your pod network. Read on to see the alternatives. After a few seconds, a Weave Net pod should be running on each Node and any further pods you create will be automatically attached to the Weave @@ -447,4 +447,8 @@ For example, ## Securing the Setup -You must pass the `password-secret` option as noted in the previous section to enable the data plane encryption; this is a recommended option in case you cannot be sure about the security of the fabric between your nodes. Read on the [Securing Connections Across Untrusted Networks](/site/tasks/manage/security-untrusted-networks/) document to see the alternatives. +You must pass the `password-secret` option as noted in the previous section to enable the data plane encryption; this is a recommended option in case you cannot be sure about the security of the fabric between your nodes. + +A different option is to use `trusted-subnets` and whitelist only the subnets that host your k8s nodes. Mind that depending on your circumstances that might allow a malicious container running in your cluster to access the weave dataplane, still. + +Read on the [Securing Connections Across Untrusted Networks](/site/tasks/manage/security-untrusted-networks/) document to see the alternatives.