Kubernetes security: clusters, workloads and shared responsibility

Learn what Kubernetes does, how its cluster components fit together, and where to review common security boundaries.

## What is Kubernetes? **Kubernetes** is an open-source platform for managing containerized workloads and services using declarative configuration and automation. It can help schedule and maintain workloads across a cluster, but it does not make an application secure by itself. An image packages an application and its dependencies; a container is a running instance. A Pod groups one or more containers that share certain resources. Kubernetes and a container runtime have different roles. See the [Kubernetes concepts overview](https://kubernetes.io/docs/concepts/) and its [Pods documentation](https://kubernetes.io/docs/concepts/workloads/pods/).

## Control plane and worker nodes A cluster includes a control plane, which manages cluster state and exposes the Kubernetes API, and worker nodes, which run workloads. A Deployment declares a desired state for a set of Pods, such as how many replicas to maintain. An operator or automation sends changes through the API; the cluster works toward the declared state. A managed provider may operate some components, but the exact division of duties depends on the service and contract. Review the [cluster architecture](https://kubernetes.io/docs/concepts/architecture/) and [Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) for the version you operate.

## Where security controls apply Start by identifying who and what can reach the API and what each identity may do. Review authentication and role-based access control, protect credentials and restrict unnecessary privileges. Kubernetes Secrets are an API for confidential configuration; check the cluster's encryption-at-rest configuration and access policies rather than assuming every Secret is encrypted in the backing store by default. Apply appropriate Pod security standards, keep images and nodes maintained, and restrict traffic using network policies where the cluster's network implementation supports enforcement. Admission controls and audit logs can add preventative and detective checks. These controls address different boundaries and must be configured and verified for the environment. The [Kubernetes security overview](https://kubernetes.io/docs/concepts/security/) and [Secrets guidance](https://kubernetes.io/docs/concepts/configuration/secret/) describe these mechanisms and limits.

## A bounded review example For a team deploying a web service, list the workloads and their service accounts, inspect API and namespace permissions, and check whether externally reachable services match the intended design. Review image provenance, allowed container privileges and policy enforcement with the cluster owner. Record which environment and configuration were actually checked; a single manifest, policy or scan result is not proof that every running workload is protected. See also [cloud workloads and container security](/cloud-workloads-container-security-misconfiguration?lang=en) and [IAM, access control and secrets management](/iam-access-control-secrets-management?lang=en).