- to deploy on demand staging or QA environment including its dependencies.
- allow service/infra devs to try services quickly without the need to use Terraform or to buy expensive instances in the first stage of the development.
I would like to share my personal experience running Meoss.
I have been using Pure Mesos setup, without DC/OS for 2.5 years.
We have the following infra features.:
- 120 micro-services running using marathon.
- 10 batch jobs running using Chronos.
- So far, everything is reliable and no downtime.
- We have Ip-Per-Task enabled with Project Calico.
- We have Public, Private, and IP Access-list enabled per container using Nginx and ELBs.
- The max number of containers we ran on the cluster so far is 3620 containers.
- We have detailed graphs monitoring per-container generated automatically.
- We have (slack #alerts) alerting enabled.
- We have secrets store using vault.
In the end we had to use (Mesos, Marathon, Chronos, Vault, Consul, Nginx, Calico, ELK, TICK.) on AWS.
The thing is, We had to configure these things to work together nicely so it is not out-of-the-box solution.
Even though we haven't used Kubernetes yet, we are not religious to Mesos.
But at the moment, it seems we have everything we need and the team is happy with the current setup.
Why would you have and production system exposing SSH to the public?
If you must, at least do these steps:
- Disable password SSH login
- Install root kit scanner, like rkhunter and check if your networked systems are infected. s/he might gained access to other instances in your infra.
- Use port scanning on all your instances and check if there is any suspecious rpc port is open that you are not familiar wtih.
- Enable unattended security upgrades.
- Check for the vulnerabilities listings for your internet facing services, like nginx, apache, HAproxy, etc..
- forward all your syslog logs to remote system so the attacker can't cleanup her/her traces after establishing the attack.
- enable automatic blockers like fail2ban.
- to deploy on demand staging or QA environment including its dependencies.
- allow service/infra devs to try services quickly without the need to use Terraform or to buy expensive instances in the first stage of the development.