Securing Meshery Installation: The best practices
We are delighted that you are loving Meshery, so it is our sole responsibility to make sure that you are in safe hands. The below few lines will describe how can you harden your security for accessing meshery so that you make eventually keep all your infrastructure sharing the same network are safe.
There are 2 scenario that people use meshery :
- A standalone installation (May be in a VM)
- A deployment in a Kubernetes cluster.
In general, each of the above installation method would need an IP (public/private IP) for you to access the meshery UI.
To Ensure you are securely accessing meshery below are the few point you should keep in mind.
It is perfectly fine to expose public endpoint / ip to evaluate Meshey provided the meshery is installed in a isolated environment (do not connect to any of the infra object in your landscape)
If you are installing Meshery in a standalone VM which share the same network of your other infrastructure object, we recommend not to Expose public IP. Instead use the VPN solution with a private endpoint to your meshery installation (the virtual machine). It is very easy to use the VPN solution if you are hosting it in any of the cloud platform
Incase you are installing meshery in side a Kubernetes cluster (which is very common), By default Meshery uses the service type as
loadBalancerwhich creates a
public ipand exposes the Meshry service to outside cluster.
This default behaviour keeps in mind that you are evaluating Meshery at the moment . Also you acknowledge, you are well aware about the behaviour of kubernetes
loadbalancer and its limitations.
But we recommend that you should always use the kubernetes service type
clusterIp while installing meshery in a production grade infrastructure. It is doable by overriding
values.yml if you are using helm installation method to install Meshery. It can also be done by the command line installation tool.
Now you can make use of
ingress component to expose and access the meshery services. However
portforward can be used for meshery evaluation and for short term usage and
ingress can be used to expose meshery from a
prod/test/dev environment where you have ingress installed.
The above points are considered to be the more safe-way to use meshery in your infrastructure.
You can find the topic how to configure Meshery behind the ingress in this link: ls-lrt.com/configuring-meshery-behind-istio..
you can find this blog here too : discuss.layer5.io/t/securing-meshery-instal..
Did you find this article valuable?
Support Samir Ranjan Parhi by becoming a sponsor. Any amount is appreciated!