<p>I would like to run a kubernetes cluster with 1 master and 2 worker nodes all 3 in different separate private subnets within our on-premise data center. What would be the best strategy to implement the kubernetes cluster while exposing front end application to public network implementing a good kubernetes security?   </p>

<p>In the cloud my answer will be different!
From what i understand טםו are not going to scale your nodes so my answer is based on that.</p>

<ol>
<li><p>Create all your services in K8S cluster (do not expose any one of them).</p></li>
<li><p>Create Nginx or any Loadbalancer that you prefer as VM (if you can create 2 VM's for HA much better).</p></li>
<li><p>Route Nginx to the Frontend (please use ingress controller that not expose)</p></li>
</ol>

<p>Now regarding security:</p>

<ol>
<li><p>Add WAF to your Loadbalancer.</p></li>
<li><p>Control on the allowed process in every container type (use Falco for that).</p></li>
<li><p>Create network policy that define what service allowed to speak with what service or i strongly suggest using Istio.</p></li>
<li><p>Create certificate to the DB and only the pods that contain certificate will able to speak with him.</p></li>
</ol>

<p>Good luck. </p>
