We're preparing an on-premises Kubernetes environment on a powerful internal server and are deciding how to structure it. First, is it advisable to expose a database's web-based administration interface through an Ingress controller or reverse proxy such as NGINX or Traefik, even if it is only reachable from the company network? What additional security controls would still be necessary? Second, should infrastructure services such as databases, monitoring, and internal tools run in the same cluster as our applications, or should they be separated into different clusters? If everything shares one cluster, how should we think about the potential failure or blast radius? Finally, what storage approach is generally recommended: HostPath, the default StorageClass, or a distributed solution such as Longhorn?
2 Answers
For on-premises persistent storage, HostPath is generally unsuitable for important workloads because it ties data to one node and does not provide convenient replication or failover. A distributed option such as Longhorn can be a practical choice for a small team because it provides replicated volumes and relatively straightforward operations. Make sure you also configure backups to an S3-compatible or other independent storage target—replication inside the cluster is not a substitute for backups. In cloud environments, the provider’s CSI-backed StorageClass is usually the simplest default, while on-premises deployments should choose based on reliability, recovery requirements, operational complexity, and available hardware.
For a database GUI, I’d avoid exposing the database service itself through Ingress. Keep the database private and provide access to a separate administrative interface through a VPN, port-forwarding, or an authenticated internal service. An Ingress or reverse proxy does not automatically make anything secure—you still need strong authentication, authorization, TLS, network restrictions, and ideally SSO or another identity provider. Treat every exposed endpoint as part of your attack surface, even on an internal network.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures