What should not be run in kubernetes?

Question

Devops

What should not be run in kubernetes?
For example, in one cluster, but in different namespaces, the registry, prometheus, gitlab, our combat application, etc. will be launched.
It doesn't look like much. What risks does it carry? And how to implement it better?

Answer 1

Assign resource quotas to namespaces and apps. If kubernetes is on pieces of iron, consider also the load on the disks. Cover yourself with cloudflare. Hang basic authorization on everything. And if possible, I would separate the prod from the infrastructure physically, so that they would not crawl through the hole on the prod.

Answer 2

Move all infrastructure applications (gitlab, registry, prometheus, graylog) to a separate cluster. if this is not possible, then allocate a separate node for them, protect their priority classes, resource quota.
Well, make backup copies, so that there is something to restore the cluster from.

Answer 3

What should not be run in kubernetes?

There is more of a question - "Who should not be allowed in?"