<p>I try to deploy a set of k8s on the cloud, there are two options:the masters are in trust to the cloud provider or maintained by myself.
so i wonder about that if the masters in trust will leak the data on workers?
Shortly, will the master know the data on workers/nodes?</p>

<p>The abstractions in Kubernetes are very well defined with clear boundaries. You have to understand the concept of Volumes first. As defined <a href="http://kubernetesbyexample.com/volumes/" rel="nofollow noreferrer">here</a>, </p>

<blockquote>
  <p>A Kubernetes volume is essentially a directory accessible to all
  containers running in a pod. In contrast to the container-local
  filesystem, the data in volumes is preserved across container
  restarts. </p>
</blockquote>

<p>Volumes are attached to the containers in a pod and There are several <a href="https://kubernetes.io/docs/concepts/storage/volumes/#types-of-volumes" rel="nofollow noreferrer">types of volumes</a></p>

<p>You can see the layers of abstraction <a href="https://kubernetes.io/docs/tutorials/kubernetes-basics/explore/explore-intro/" rel="nofollow noreferrer">source</a><a href="https://i.stack.imgur.com/S7pgW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/S7pgW.png" alt="The layers of abstraction"></a></p>

<p><strong>Master to Cluster communication</strong> </p>

<p>There are two primary communication paths from the master (apiserver) to the cluster. The first is from the apiserver to the kubelet process which runs on each node in the cluster. The second is from the apiserver to any node, pod, or service through the apiserver’s proxy functionality.</p>

<p>Also, you should check <a href="https://kubernetes.io/docs/concepts/architecture/cloud-controller/" rel="nofollow noreferrer">the CCM</a> - The cloud controller manager (CCM) concept (not to be confused with the binary) was originally created to allow cloud specific vendor code and the Kubernetes core to evolve independent of one another. The cloud controller manager runs alongside other master components such as the Kubernetes controller manager, the API server, and scheduler. It can also be started as a Kubernetes addon, in which case it runs on top of Kubernetes.</p>

<p>Hope this answers all your questions related to Master accessing the data on Workers. </p>

<p>If you are still looking for more secure ways, check <a href="https://kubernetes.io/blog/2018/07/18/11-ways-not-to-get-hacked/" rel="nofollow noreferrer">11 Ways (Not) to Get Hacked</a></p>
