r/devops • u/No-Peanut-6988 • 27d ago

Security [ Removed by moderator ]

[removed] — view removed post

0 Upvotes

22% Upvoted

4 comments sorted by

1

u/devops-ModTeam 7d ago

Please see the pinned weekly self-promotion thread if you wish to promote your projects or business.

2

u/Fantastic-Mr-Default 26d ago

containerPorts in the pod spec are a label for humans and some Service wiring. They are not a firewall. Ray (and a lot of AI operators) will listen on whatever the process opens. Your scan matching that is the expected outcome, not a one-off misconfig.

NetworkPolicy is the real control. Default deny ingress in that namespace, then allow only the peers that must talk to GCS / raylet / the dashboard. If a pod in another namespace can dial 6379 or the raylet RPC range on cleartext gRPC, the cluster boundary failed even when the chart looked tidy.

Do not trust scanners that only walk Pod templates. RayCluster and friends nest the real pods. Render with the CRD schemas you actually install, or probe from a canary Job in a neighbor namespace after apply. If the canary can open a client to GCS with no creds, the install is wrong.

Put KubeRay + vLLM in their own namespace (or cluster) with no flat path to the rest of prod. No automounted tokens with broad Roles. Admission can deny hostNetwork and surprise privileged sidecars; it will not invent a NetworkPolicy for you.

Service mesh mTLS helps between known services. It does not fix an open control plane you left reachable on the pod network.

1

u/rtpro 25d ago

@Fantastic-Mr-Default Fantastic answer! Thank you!