<p>I've seen <a href="https://stackoverflow.com/questions/49461575/kubernetes-securing-services">Kubernetes Securing services</a> but I am asking a more basic question. </p>

<p>How are the services secured? I have a repository layer that should not be available outside of the cluster, but only available to services within the cluster. I can't quite see how I can use kubernetes to handle that or whether it does it itself.</p>

David Boshton
<p>If you mean network level security by restricting how the service is accessed , then there are many types of kubernetes options that you use for exposing the service , but in your case , you expose it using the <strong>Service</strong> of <strong>Type</strong> <strong>ClusterIP</strong> so that it is only available <strong>inside the cluster</strong>.</p>

<blockquote>
  <p>Types of Services There are five types of Services:</p>
  
  <p>ClusterIP (default): Internal clients send requests to a stable
  internal IP address.</p>
  
  <p>NodePort: Clients send requests to the IP address of a node on one or
  more nodePort values that are specified by the Service.</p>
  
  <p>LoadBalancer: Clients send requests to the IP address of a network
  load balancer.</p>
  
  <p>ExternalName: Internal clients use the DNS name of a Service as an
  alias for an external DNS name.</p>
  
  <p>Headless: You can use a headless service in situations where you want
  a Pod grouping, but don't need a stable IP address.</p>
</blockquote>

<p>Here is a manifest for a Service of type ClusterIP:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: my-cip-service
spec:
  selector:
    app: metrics
    department: sales
  type: ClusterIP
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080
</code></pre>
