Google admits Kubernetes container tech is too complex
I understand their rationale. We manage thousand Kubernetes clusters and end-users can find lots and lots of creative way to shoot themselves in the foot:<p>- I can store anything in a secret? Let&#x27;s have thousands of cat images. Etcd then stops working because we have over 2GB of funny cats in the key store.<p>- I can run a root Pod? Lets mount the docker socket and start building images with it. Oh and by the way, I never clean those up and my Node simply fills up. Also I add some additional docker networks that break Pod to Pod networks.<p>- Istio is nice - why we don&#x27;t add automatic injection for Pods in all namespaces? Including kube-system? And then they brick kube-proxy and the cluster stops working.<p>- I can use validating webhooks for better security? Lets watch on all resources. To keep it more secure lets set the failure policy of the webhook to Fail, so we never admit any modification without the apiserver to make a call to out webhook. Whats that? My single replica webhook has was evicted from the Pod (we didn&#x27;t add any resource requests and limits) and now it cannot even be created or scheduled because kube-controller-manager and kube-scheduler cannot update their lease and they lost leadership and now are idling, effectively bricking the entire cluster.<p>Google would reduce the pain points with this change, however they would still face countless other issues with Kubernetes.