Why separate the admin app from the storefront, and how should DBAs access a private database?
Asked by
MellowPine42
I'm designing a food-delivery application with separate frontend, backend, and admin containers. The frontend serves customers, while the backend handles the APIs and business logic. I'm trying to understand whether the admin container would typically be a separate web application for staff to manage products, users, orders, and reviews, and why it would be deployed separately instead of being part of the main frontend or backend.
I also want to understand the distinction between the admin application and direct database administration. If the database is private, would an administrator or DBA normally connect with a tool such as DBeaver through a VPN, bastion host, or another private-network tunnel? What is the recommended production pattern, especially when these services will eventually run on Kubernetes?
Answers
A separate admin container usually hosts a separate web application for internal staff. Keeping it separate lets you deploy or scale it independently, restrict it behind an internal ingress or IP allowlist, and keep the public customer-facing application isolated. The admin UI should normally call backend APIs with narrowly scoped business permissions rather than connecting directly to the database.
Reply to this answer
In Kubernetes, avoid putting broad database credentials in a permanent admin pod. Use properly scoped service accounts and secrets for applications, and use an ephemeral toolbox pod or a temporary port-forward during approved maintenance work. If the application needs schema migrations, run them as a controlled Job that exits after completion rather than leaving a powerful container running continuously.
Reply to this answer
Database administration is a different access path from using the admin application. Keep the database private and provide authorized DBAs with short-lived access through a VPN, bastion host, or Kubernetes port-forwarding. For example, an approved operator could forward a database service to localhost and connect DBeaver to that local port. This avoids exposing the database publicly and allows access to be authenticated and audited.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions