Most tutorials I read nowadays include some parts where the author suddenly writes: This setting is terrible and should never be enabled in a production environment, however since this is just a demo I'll use it either way! So in the end I usually have to stick to the official documentation + forum posts... I really dont understand (money and clicks...) how someone can be proud of their tutorials when they aren't even remotely production ready...

Sweet, I was looking for something like this. Please let me know when you write a tutorial addressing these points so I can help follow it. Link it here!

You bring up a lot of great points. I disabled the firewall on my bare metal cluster nodes and didn’t give it another thought. I had to go digging to figure out how to encrypt secrets, and NFS StorageClass is not very great security wise either. Not to mention lack of isolation for privileged containers. I found kata containers a good solution to that. Then there’s wireguard between workers I don’t know if I got working correctly because I can’t figure out how to really test it.

I have run into this issue a lot, I have always found that most of the tutorials set things up in isolation and never talk about integration points or how to build a whole solution.

On the MetalLB configmap point, that’s another issue I have run into. In the earlier days of metallb it was configured differently and the configmap was automatically created but that has since changed, took me a bit to figure out when that changed as their docs aren’t explicit if I remember correctly. Annoying either way.

I think the reason most tutorials turn off the firewall is in a well configured cloud environment like AWS the host firewall is redundant due to security groups and that is what everyone targets the tutorials for unfortunately and they never explain that even with “disable this if you have other mitigating controls in place” or something.

I have also wondered if we have finally reached the era where the majority of content creators and consumers have never touched an on-prem network and don’t even think about that lens anymore, another good example of this is trying to configure MetalLB in a host with multiple interface that don’t have the same networks available (you know, like using dedicated interfaces for storage like you should), for a long time it just wasn’t possible and metallb would announce all networks on all interfaces which made it basically not functional heh. Whatever the reason is, you are not alone in being annoyed :D

Anyway, these are great points, I have been pondering writing up a larger set of tutorial about my setup since it’s more similar to a small enterprise anymore, I should get on that hah.

Most tutorials only want clicks and for it to "work"...

Pretty frustrating.

A couple of main points:

• You are reading tutorials to help you get it up and running. Most of the time these are designed to walk you through setting things up on a fresh node, and most often just VMs on an isolated (trusted) network. When you are providing a guide to just get someone up and running, the first thing to do is establish a known baseline configuration to start from.
• Kubernetes is a complex distributed application, and as such, the audience is generally expected to be relatively experienced. Meaning if you don't know how to configure your firewall, people assume you aren't going through this tutorial.

Still, I feel your pain. When trying to get into these technologies, most people who have done the work are engineers, and we stink at writing documentation. I'm sure you're familiar with it, we automate the solutions for issues we encounter, and then those tools or automatic configurations fail to make it to the end user.

And I'm probably biased, but don't use a video guide for this sort of thing. It's just the wrong medium for a technical tutorial.