Administrators at hospitals and clinics increasingly hear a sentence like “our scheduling platform runs on Kubernetes” without ever being told what that implies for safety. This explainer is written for them: non-engineers who handle suppliers, budgets or compliance paperwork and need a clear mental model. It is general technology information and contains nothing clinical. The subject is KubernetesSecOps, a name the Ops Atlas uses for the daily work of protecting a cluster, and we will build the picture using ordinary office ideas: doors, keys, visitor books, and sealed envelopes.
First, the basic term
Think of a cluster as several computers managed together as one pool. Software is packaged into small units called containers, and Kubernetes decides which computer runs which container, restarts anything that stops and routes traffic between them. Picture a large administration floor where a coordinator assigns tasks to desks and reassigns them when someone is away. The coordinator is very capable, and that is exactly why controlling who can instruct the coordinator matters so much.
What does KubernetesSecOps cover?
The Atlas organises the subject around five concerns: control over changes to the cluster, control over which programs are admitted, limits on which programs may contact each other, safe storage of credentials, and the ability to notice an attack. It leaves other jobs to neighbouring disciplines, including building the container packages, upgrading and backing up the cluster, cloud account settings and the triage of alerts. For the full list and the reasoning behind it, the Atlas has a long entry; you can read that long-form KubernetesSecOps entry after this explainer if you want depth.
The coordinator’s front door: who may instruct it
Every instruction to the coordinator passes through a sequence of checks. Step one confirms your identity. Step two confirms that you hold the right to make this specific request. Then, for requests that change things, it applies a further set of rules about what is acceptable, before the change is stored and carried out. A request that only asks to read information stops after the second check.
For administrators, the most useful insight is that permissions are often broader than anyone intended. The Atlas lists specific powers that deserve review: being able to read the sealed envelopes (Secrets), to start new programs, to open a command line inside a running program, to pose as another user, and to approve new certificates. And it states one rule without qualification: do not add people to the group that skips permission checks, since it bypasses all of them. Ask your technical team a simple question: who can do these things, and when was that last reviewed?
Sealed envelopes: how secrets are kept
Passwords and keys inside a cluster are stored as objects called Secrets. The Atlas points out that, unless encryption is configured, they are written unprotected into the cluster’s database. And people often believe an unreadable-looking string is safe. It is not; base64 simply rewrites data into ordinary characters. It is like putting a letter in a transparent envelope and writing the address in capital letters.
Two practical options help. One is encryption of the database contents using the current key-management approach. The other is to keep credentials outside the cluster altogether and fetch them on demand, a job for add-ons like the External Secrets Operator, which the Atlas mentions. With that route, the sealed envelope never sits in the cluster for long, which narrows what an intruder could find even if something else goes wrong. Ask your technical team which approach is in use and how they verified it.
Visitor books: what gets recorded
A visitor book matters only if someone writes in it. The cluster equivalent is an audit log. On clusters you run yourself, nothing is recorded until a policy is supplied. On hosted clusters, defaults vary: one major provider needs logs to be turned on, while a different provider retains administrator actions permanently but leaves data-access records off until requested. The Atlas also cautions that the logging rules are applied in order, so a broad rule early in the list can hide the precise ones below it.
A good question for a supplier is therefore simply: where are your audit logs, how long are they kept, and who reads them?
Doors between rooms: network rules
Inside a cluster, programs can normally talk to each other freely. Network policies are the doors. Without them, a problem in one program can spread sideways. The Atlas recommends starting with a rule that denies everything in a namespace and then opening only the paths required. A namespace, by the way, is a named section of the cluster; it is useful for organisation, but it does not isolate programs from each other in a hard sense, since they share the same underlying system on a machine.
When evaluating suppliers or tools, a short method for researching technology choices, such as the article on researching software with care before committing to it, gives you questions to ask in the meeting.
House rules for what may start
The cluster can also check each new program against house rules. The strictest standard in the Atlas, the restricted profile, requires a program to operate as a standard account instead of the all-powerful one, be barred from acquiring extra privileges, sit behind the default system-call filter and hold no special capabilities. The Atlas recommends introducing such rules gently: view-only first, then visible warnings with a published date, then enforcement. It lists switching on every sample rule at once as a pattern to avoid, as well as giving automated pipelines unlimited administrator power.
Two details are worth knowing. Rules act on individual pods, so a rule that looks fine on paper may behave differently on what actually runs. And an exemption given to a controller’s account quietly extends to everyone allowed to create the same kind of program. That is why each exemption belongs in a register, with someone accountable, a stated purpose and a lapse date.
Why defaults deserve a second look
One more idea helps administrators challenge assumptions. Out of the box, Kubernetes favours convenience. The Atlas states that pods accept connections from everywhere until a rule selects them, that Secrets sit unencrypted unless configured, and that the keys to the most sensitive parts of the system, such as direct access to the cluster’s database, bypass the normal audit trail. Write access to that database is described as equivalent to full control of everything. This is not alarming news; it is simply the reason a protection routine exists. Equipment shipped with default passwords has always needed a first-day setup, and clusters are no different.
What good looks like from the outside
As an administrator you do not inspect the cluster yourself. You look for signs of a healthy routine. Does your technical team report percentages, such as how many namespaces have network rules and pod safety rules? Do they review refused requests weekly, exceptions monthly and permissions quarterly? Is there a yearly rehearsal with whoever handles incidents? The Atlas gives a five-stage ladder from default settings to assured, with the last stage reached only after two quarters of passed drills. You do not need to know the commands; you need to know which rung your team is standing on, and for how long.
Teams that run production systems well tend to share a mindset of steady reliability work, which the piece on building dependable skills for cloud and production systems describes in accessible terms.
Five quick questions to keep
- Who holds the power to alter the cluster, and when did anyone last check that list?
- Are stored secrets encrypted, and has anyone checked by reading one directly?
- Are audit logs switched on, kept and read?
- Which namespaces have a default-deny network rule?
- Where is the exception register, and which entries have expired?
If answers come back quickly and in writing, that is a good sign. If they come back slowly, that is information too, and it points to the first thing to improve.