<p>Is that possible to deploy an openshift in DMZ zone ( Restricted zone ).What are the challenges i will face?.What are the things i have to do in DMZ zone network?</p>

kali doss
<p><strong>You can deploy Kubernetes and OpenShift in DMZ.
You can also add DMZ in front of Kubernetes and OpenShift.</strong></p>

<p>The Kubernetes and OpenShift network model is a flat SDN model. All pods get IP addresses from the same network CIDR and live in the same logical network regardless of which node they reside on.</p>

<p>We have ways to control network traffic within the SDN using the NetworkPolicy API. NetworkPolicies in OpenShift represent firewall rules and the NetworkPolicy API allows for a great deal of flexibility when defining these rules.</p>

<p>With NetworkPolicies it is possible to create zones, but one can also be much more granular in the definition of the firewall rules. Separate firewall rules per pod are possible and this concept is also known as microsegmentation (see this post for more details on NetworkPolicy to achieve microsegmentation).</p>

<p>The DMZ is in certain aspects a special zone. This is the only zone exposed to inbound traffic coming from outside the organization. It usually contains software such as IDS (intrusion detection systems), WAFs (Web Application Firewalls), secure reverse proxies, static web content servers, firewalls and load balancers. Some of this software is normally installed as an appliance and may not be easy to containerize and thus would not generally be hosted within OpenShift.</p>

<p>Regardless of the zone, communication internal to a specific zone is generally unrestricted.</p>

<p>Variations on this architecture are common and large enterprises tend to have several dedicated networks. But the principle of purpose-specific networks protected by firewall rules always applies.</p>

<p>In general, traffic is supposed to flow only in one direction between two networks (as in an osmotic membrane), but often exceptions to this rule are necessary to support special use cases.</p>

<p>Useful article: <a href="https://blog.openshift.com/openshift-and-network-security-zones-coexistence-approaches/" rel="nofollow noreferrer">openshift-and-network-security-zones-coexistence-approache</a>.</p>

<p>It's very secure if you follow <a href="https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/" rel="nofollow noreferrer">standard security practices</a> for your cluster. But nothing is 100% secure. So adding a DMZ would help reduce your attack vectors. </p>

<p>In terms of protecting your Ingress from outside, you can limit your access for your external load balancer just to HTTPS, and most people do that but note that HTTPS and your application itself can also have vulnerabilities.</p>

<p>As for pods and workloads, you can increase security (at some performance cost) using things like a well-crafted <a href="https://github.com/docker/labs/tree/master/security/seccomp" rel="nofollow noreferrer">seccomp</a> profile and or adding the right <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">capabilities</a> in your pod security context. You can also add more security with <a href="https://docs.docker.com/engine/security/apparmor/#load-and-unload-profiles" rel="nofollow noreferrer">AppArmor</a> or <a href="https://www.projectatomic.io/docs/docker-and-selinux/" rel="nofollow noreferrer">SELinux</a>, but lots of people don't since it can get very complicated.</p>

<p>There are also other alternatives to Docker in order to more easily sandbox your pods (still early in their lifecycle as of this writing): <a href="https://katacontainers.io/" rel="nofollow noreferrer">Kata Containers</a>, <a href="https://nabla-containers.github.io/" rel="nofollow noreferrer">Nabla Containers</a> and <a href="https://github.com/google/gvisor" rel="nofollow noreferrer">gVisor</a>.</p>

<p>Take look on: <a href="https://stackoverflow.com/questions/52781946/should-i-add-a-dmz-in-front-of-kubernetes/52782700#52782700">dmz-kubernetes</a>.</p>

<p>Here is similar problem: <a href="https://www.reddit.com/r/kubernetes/comments/8t4itf/kubernetes_and_the_dmz/" rel="nofollow noreferrer">dmz</a>.</p>
