Hacker News new | ask | show | jobs
by sitkack 2732 days ago
What would a production-grade conformance test suite look like for K8s to get these operators to 1.0?

I am mostly a bystander, but in the k8s issues I see, it is too easy to either destroy all the pods or their volumes. Maybe this should be fixed at the k8s level.
2 comments
ryukafalz 2732 days ago
>too easy to either destroy ... their volumes.

As someone who's started running services in Kubernetes (albeit mostly as a hobby thus far) I would recommend setting the ReclaimPolicy to Retain for any PersistentVolumes that are particularly important. The default behavior is to delete the underlying volume when the resource representing it is deleted, but if you're worried that might happen accidentally that may not be what you want; this behavior is configurable.

link
mdaniel 2731 days ago
> Maybe this should be fixed at the k8s level.

FWIW, it has been: RBAC allows you to strip -- or I guess pragmatically speaking, not assign -- rights at whatever level of granularity you have the patience to maintain. It is also bright enough to do that per Namespace, so going light on the ClusterRoleBindings and keeping things out of the "production-db" Namespace would likely go a long way toward addressing the risk you are describing

link