<p>TL;DR Kubernetes allows all containers to access all other containers on the entire cluster, this seems to greatly increase the security risks. How to mitigate?</p>

<p>Unlike <a href="https://www.docker.com/" rel="nofollow">Docker</a>, where one would usually only allow network connection between containers that need to communicate (via <code>--link</code>), each <em>Pod</em> on <a href="http://kubernetes.io/" rel="nofollow">Kubernetes</a> can access all other Pods on that <em>cluster</em>.</p>

<p>That means that for a standard Nginx + PHP/Python + MySQL/PostgreSQL, running on Kubernetes, a compromised Nginx would be able to access the database.</p>

<p>People used to run all those on a single machine, but that machine would have serious periodic updates (more than containers), and SELinux/AppArmor for serious people.</p>

<p>One can mitigate a bit the risks by having each project (if you have various independent websites for example) run each on their own cluster, but that seems wasteful.</p>

<p>The current <a href="https://github.com/kubernetes/kubernetes/blob/master/docs/design/security.md" rel="nofollow">Kubernetes security</a> seems to be very incomplete. Is there already a way to have a decent security for production?</p>

<p>In the not-too-distant future we will introduce controls for network policy in Kubernetes.  As of today that is not integrated, but several vendors (e.g. Weave, Calico) have policy engines that can work with Kubernetes.</p>
