Security [page]deterministic

This section of the Kubernetes documentation aims to help you learn to run workloads more securely, and about the essential aspects of keeping a Kubernetes cluster secure.

Kubernetes is based on a cloud-native architecture, and draws on advice from the [CNCF](#gloss:cncf) about good practice for cloud native information security.

Read [Cloud Native Security and Kubernetes](/docs/concepts/security/cloud-native-security/) for the broader context about how to secure your cluster and the applications that you're running on it.

## Kubernetes security mechanisms {#security-mechanisms}

Kubernetes includes several APIs and security controls, as well as ways to define [policies](#policies) that can form part of how you manage information security.

### Control plane protection

A key security mechanism for any Kubernetes cluster is to [control access to the Kubernetes API](/docs/concepts/security/controlling-access).

Kubernetes expects you to configure and use TLS to provide [data encryption in transit](/docs/tasks/tls/managing-tls-in-a-cluster/) within the control plane, and between the control plane and its clients. You can also enable [encryption at rest](/docs/tasks/administer-cluster/encrypt-data/) for the data stored within Kubernetes control plane; this is separate from using encryption at rest for your own workloads' data, which might also be a good idea.

### Secrets

The [Secret](/docs/concepts/configuration/secret/) API provides basic protection for configuration values that require confidentiality.

### Workload protection

Enforce [Pod security standards](/docs/concepts/security/pod-security-standards/) to ensure that Pods and their containers are isolated appropriately. You can also use [RuntimeClasses](/docs/concepts/containers/runtime-class) to define custom isolation if you need it.

[Network policies](/docs/concepts/services-networking/network-policies/) let you control network traffic between Pods, or between Pods and the network outside your cluster.

You can deploy security controls from the wider ecosystem to implement preventative or detective controls around Pods, their containers, and the images that run in them.

### Admission control {#admission-control}

[Admission controllers](/docs/reference/access-authn-authz/admission-controllers/) are plugins that intercept Kubernetes API requests and can validate or mutate the requests based on specific fields in the request. Thoughtfully designing these controllers helps to avoid unintended disruptions as Kubernetes APIs change across version updates. For design considerations, see [Admission Webhook Good Practices](/docs/concepts/cluster-administration/admission-webhooks-good-practices/).

### Auditing

Kubernetes [audit logging](/docs/tasks/debug/debug-cluster/audit/) provides a security-relevant, chronological set of records documenting the sequence of actions in a cluster. The cluster audits the activities generated by users, by applications that use the Kubernetes API, and by the control plane itself.

## Cloud provider security

If you are running a Kubernetes cluster on your own hardware or a different cloud provider, consult your documentation for security best practices. Here are links to some of the popular cloud providers' security documentation:

IaaS Provider | Link | -------------------- | ------------ | Alibaba Cloud | https://www.alibabacloud.com/trust-center | Amazon Web Services | https://aws.amazon.com/security | Google Cloud Platform | https://cloud.google.com/security | Huawei Cloud | https://www.huaweicloud.com/intl/en-us/securecenter/overallsafety | IBM Cloud | https://www.ibm.com/cloud/security | Microsoft Azure | https://docs.microsoft.com/en-us/azure/security/azure-security | Oracle Cloud Infrastructure | https://www.oracle.com/security | Tencent Cloud | https://www.tencentcloud.com/solutions/data-security-and-information-protection | VMware vSphere | https://www.vmware.com/solutions/security/hardening-guides |

## Policies

…(trimmed)