<p>I'd like to deploy kubernetes on a large physical server (24 cores) and I'm uncertain as to a number of things.</p>

<p>What are the pros and cons of creating virtual machines for the k8s cluster other than running on bare-metal.</p>

<p>I have the following considerations:</p>

<ul>
<li>Creating vms will allow for work load isolation. New vms for experiments can be created and assigned to devs.</li>
<li>On the other hand, with k8s running on bare metal a new NAMESPACE can be created for each developer for experimentation and they can run their code in it. After all their code should be running in docker containers.</li>
</ul>

<p><strong>Security:</strong></p>

<ul>
<li>Having vms would limit the amount of access given to future maintainers, limiting the amount of damage that could be done. While on the other hand the primary task for any future maintainers would be adding/deleting nodes and they would require bare metal access to do that.</li>
</ul>

<p><strong>Authentication:</strong></p>

<ul>
<li>At the moment devs would only touch the server when their code runs through the CI pipeline and their running deployments are deployed. But what about viewing logs? Could we setup tiered kubectl authentication to allow devs to only access whatever namespaces have been assigned to them (I believe this should be possible with the k8s namespace authorization plugin).</li>
</ul>

<p>A number of vms already exist on the server. Would this be an issue?</p>

<p>I would separate dev and prod in the form of different vms. I once had a webapp inside docker which used too many threads so the docker daemon on the host crashed. It was limited to one host luckily. You can protect this by setting limits, but it's a risk: one mistake in dev could bring down prod as well. </p>
