Are there issues with running user pods on a Kubernetes master node?
<p>Many of the run-throughs for deploying Kubernetes master nodes suggest you use <code>--register-schedulable=false</code> to prevent user pods being scheduled to the master node (e.g. <a href="https://coreos.com/kubernetes/docs/latest/deploy-master.html" rel="noreferrer">https://coreos.com/kubernetes/docs/latest/deploy-master.html</a>). On a very small Kubernetes cluster it seems somewhat a wasteful of compute resources to effectively prevent an entire node from being used for pod scheduling unless absolutely essential. </p>

<p>The answer to this question (<a href="https://stackoverflow.com/questions/27832984/will-can-kubernetes-run-docker-containers-on-the-master-nodes">Will (can) Kubernetes run Docker containers on the master node(s)?</a>) suggests that it is indeed possible to run user pods on a master node - but doesn't address whether there are any issues associated with allowing this.</p>

<p>The only information that I've been able to find to date that suggests there might be issues associated with allowing this is that it appears that pods on master nodes communicate insecurely (see <a href="http://kubernetes.io/docs/admin/master-node-communication/" rel="noreferrer">http://kubernetes.io/docs/admin/master-node-communication/</a> and <a href="https://github.com/kubernetes/kubernetes/issues/13598" rel="noreferrer">https://github.com/kubernetes/kubernetes/issues/13598</a>). I assume that this would potentially allow a rogue pod running on a master node to access/hijack Kubernetes functionality not normally accessible to pods on non-master nodes. Probably not a big deal with if only running pods/containers developed internally - although I guess there's always the possibility of someone hacking access to a pod/container and thereby gaining access to the master node. </p>

<p>Does this sound like a viable potential risk associated with this scenario (allowing user pods to run on a Kubernetes master node)? Are there any other potential issues associated with such a setup?</p>