Commits on May 6, 2020

1. data/azure: Use a single network security group for Azure clusters …

   The Kubernetes service load balancer programs a cluster specific
   Azure NSG automatically to expose service load balancers. OpenShift
   requires all nodes to be able to host service load balancer workloads
   and so the simplest configuration is to have a single network security
   group for the whole cluster. This does require exposing port 6443 on
   all nodes, but in practice this does not reduce security because we
   cannot rely on network security within the cluster to protect
   workloads.
   
   As a result of this change, a 3 node compact Azure cluster can be
   grown to have a worker pool at runtime with no disruption to the
   router or other components that depend on service load balancer.

   

   smarterclayton committed May 6, 2020
   Configuration menu

   • View commit details
   • Copy full SHA for 7857e67
   • Browse repository at this point

   Copy the full SHA

   7857e67 View commit details

   Browse the repository at this point in the history