Home / Knowledge hub / Kubernetes
Knowledge hub
Kubernetes
A system that runs and manages containers across many machines.
What it means
Kubernetes is open-source software that runs containers across a group of machines and keeps them running as you described. You say what should exist, such as three copies of a service, and Kubernetes starts, restarts and moves containers to match.
A group of machines under its control is called a cluster. Containers run inside pods, which are scheduled onto worker machines, while a control plane holds the desired state and makes decisions. Almost everything is configured through an API.
Why it matters
Kubernetes gives you a lot of power in one place. Whoever can reach its API, or a powerful account inside it, can often start workloads, read secrets and change networking. A mistake in one setting can touch every service in the cluster.
It is also easy to run it loosely. Many defaults favour getting things working over locking things down, so a cluster built from a tutorial can carry open network paths and over-broad permissions into production.
How it shows up
You meet it as manifests, Helm charts and a managed service from a cloud provider. The pieces to review are the API server's exposure, role-based access, how secrets are stored, which pods are allowed to run with extra powers, and which pods may talk to which.
The mistakes repeat. Cluster admin rights are handed out to ease a deadline. Pods run as root. Nothing restricts traffic between namespaces. A dashboard or kubelet port is reachable from outside. Treat cluster configuration like application code: review it, test it and keep it in version control.
Questions people ask
Kubernetes, answered
Is Kubernetes secure by default?
Not fully. It provides the building blocks for security, such as access control, network policy and pod restrictions, but several are off or permissive until you set them up.
Does a managed Kubernetes service remove the risk?
It removes some of it, such as looking after the control plane machines. You are still responsible for workloads, access rules, secrets and network settings inside the cluster.
What is a pod?
A pod is the smallest unit Kubernetes runs. It holds one or more containers that share a network address and storage.
How do we test a cluster?
Review its configuration against hardening guidance, check what is reachable from outside, and test the applications running on it. Configuration and application tests find different problems.
Is Kubernetes the same as Docker?
No. Docker builds and runs containers on one machine. Kubernetes decides where containers run across many machines and keeps them in the state you asked for.
Sources
Where this comes from
Related
Terms that sit next to this one
Docker
A tool for packaging an app and its dependencies into a portable container.
Kubernetes RBAC
Rules for which accounts and services may do what inside a Kubernetes cluster.
Cluster hardening
Tightening a Kubernetes setup against published good-practice benchmarks.
Kubernetes network policy
Rules that say which pods may talk to which other pods.
Kubernetes secrets
Kubernetes objects for passwords and keys, stored encoded but not encrypted by default.
What does your cluster expose?
We test the applications that run on your cluster, from outside and with signed-in accounts, and report only what we exploited. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.