A Kubernetes cluster coordinates machines that provide the control plane and execution resources for workloads. Kubernetes serves as a self-service platform for deploying and running applications in production, while platform engineering teams typically install and secure the cluster. section 3.2
Running services securely on Kubernetes requires:
- Secure container images that can be patched when vulnerabilities affect their base layers. section 3.2 section 3.3
- Kubernetes deployment manifests written in YAML and configured according to security best practices. section 3.2 section 3.4
- An understanding that platform teams secure the cluster, while development teams secure images and manifests. section 3.2
A practical security boundary
A development team can containerize an application and write its deployment manifest, but installing and securing the Kubernetes cluster generally remains a platform engineering responsibility. A service mesh can simplify mutual TLS between services, while an API gateway can simplify API-key protection. section 3.2 section 3.3
