A Kubernetes worker node is a physical or virtual machine that hosts pods, which run one or more containers. The cluster control plane manages the desired configuration applied across worker nodes, while the Kubernetes API server provides the central interface for deployments and configuration changes. section 4.3.4
Treat worker nodes as both workload infrastructure and a security boundary:
- Use pods as the basic deployment unit; a pod usually represents one application instance. section 4.3.4
- Account for services when assessing exposure: services route traffic to groups of pods and can expose worker nodes externally. section 4.3.4
- Apply strong segmentation because an attacker gaining access to one worker node may move laterally to others. section 4.3.4
- In AKS, track worker-node operating-system, runtime, and Kubernetes patching because Microsoft supplies updates but does not automatically apply them. section 4.3.5
AKS responsibility boundary
When an AKS cluster is created, Azure configures the control plane. The customer still manages worker-node OS and runtime patches and keeps the Kubernetes version current. section 4.3.5
Use the cluster architecture figure to distinguish the control plane from the worker nodes that host application pods. section 4.3.4
