Kubernetes automates the deployment and scaling of containers, which concentrates both management and risk in the control plane: the API server, etcd datastore, scheduler, and node agents. Security spans cluster hardening, RBAC, network policies, secrets, admission control, image provenance, pod isolation, and the nodes underneath.
Key points
Control-plane protectionRestrict API access, enforce RBAC and admission policies, encrypt etcd, and keep the dashboard and management endpoints off public networks.
Pod constraintsUse least-privilege service accounts, network policies, restricted pod security standards, and read-only or minimal container permissions.
Important limitationKubernetes defaults prioritize operability, not isolation — a default cluster is broadly permissive. Security also extends beyond the platform: vulnerable images, supply-chain compromise, and exposed node services bypass cluster controls entirely.