Kubernetes security covers who can reach the API, what workloads may do, how secrets are stored and how tenants are isolated.
Containers share the host kernel, so untrusted code needs a sandbox. gVisor intercepts system calls in user space; Kata Containers runs each Pod in its own VM.
A NetworkPolicy is an allow-list firewall rule for Pods. A policy that selects every Pod and allows nothing sets a default deny, if your CNI enforces it.
Workload identity federation lets Pods and CI jobs trade a short-lived OIDC token for temporary cloud credentials, so no static keys are stored anywhere.
Kubernetes Secrets are base64, not encrypted. Encrypt etcd, restrict RBAC, keep values in Git encrypted or in an external store, and drop cloud keys entirely.
Isolate tenants with namespaces, RBAC, quotas and network policies. Add dedicated nodes or sandboxed runtimes for hostile tenants, or a cluster each.
Kubernetes RBAC grants API permissions through Roles and ClusterRoles, which RoleBindings and ClusterRoleBindings attach to users, groups and service accounts.
Secure the Kubernetes API in four layers: network exposure, short-lived SSO credentials, least-privilege RBAC and audit logs sent outside the cluster.
Create a managed Kubernetes cluster in minutes. Every new account gets €200 in credit, so you can explore the full platform with no charge until it's used or expires.