<p><a href="https://i.stack.imgur.com/OyFnO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OyFnO.png" alt="diagram of connections between components in a k8s cluster" /></a></p>
<p>One Kubernetes cluster contains several components, for example, kubelet, etcd, api-server, etc.</p>
<p>We need to set up many certificates and keys when setting up a cluster, then they can carry these certificates to communicate with each other.</p>
<pre><code>&gt; kubectl describe pod kube-apiserver-controlplane -n=kube-system


Name:                 kube-apiserver-controlplane
Namespace:            kube-system
...
Controlled By:  Node/controlplane
Containers:
  kube-apiserver:
    Container ID:  docker://6974d026de0b2fadb3d2628d0df971ddc4c3d772665b2cd960a1d0e385f97a5d
    Image:         k8s.gcr.io/kube-apiserver:v1.20.0
    Image ID:      docker-pullable://k8s.gcr.io/kube-apiserver@sha256:8b8125d7a6e4225b08f04f65ca947b27d0cc86380bf09fab890cc80408230114
    Command:
      kube-apiserver
      ...
      --client-ca-file=/etc/kubernetes/pki/ca.crt
      --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
      --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
      --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
      --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
      --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
      --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
      --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
      ...
      ...
</code></pre>
<p>I know the concept of Certificate Authority(CA), Certificate, mTLS, and the mechanism of HTTPs.</p>
<p>I know the zero-trust model.</p>
<p><strong>But I don't understand what security risk these Kubernetes certificates try to solve.</strong></p>
<p>If the hacker can get root access to our node, they can view everything including the certificate, this complexity seems not to give us more security.</p>
<h2>Questions</h2>
<ul>
<li><p>What security risks are the most important (common) for a Kubernetes cluster?</p>
</li>
<li><p>If I don't use certificates to protect internal communication within a cluster, how will the hacker attack me?</p>
<p>As far as I know, the communication between AWS load balancer and EC2 is HTTP instead of HTTPs, it seems fine. Why are certificates not required between the load balancer and EC2, but required within a Kubernetes cluster?</p>
</li>
</ul>

Ryan Lyu
<p>Trying to answer your multiple questions from my view:</p>
<blockquote>
<p>But I don't understand what problem these Kubernetes certificates try to solve.</p>
</blockquote>
<ol>
<li><p>According to <a href="https://en.wikipedia.org/wiki/Zero_trust_security_model" rel="nofollow noreferrer">Zero trust security model</a>, the main concept behind the zero trust security model is &quot;<strong>never trust, always verify</strong>”.</p>
<p>Kubernetes expects that all API communication in the cluster is encrypted by default with TLS, which always checks the <strong>identity and integrity</strong> of communication between different components.</p>
<p>One common scenario is referred to as a <a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack" rel="nofollow noreferrer">man-in-the-middle attack</a>.</p>
</li>
</ol>
<blockquote>
<p>What security risks are the most important (common) for a Kubernetes
cluster?</p>
</blockquote>
<ol start="2">
<li><p>I think the most important security emphysis for a Kubernetes cluster are <code>tls for all traffic</code>/<code>Authentication</code>/<code>Authorization</code>.</p>
<p>You could also refer to the official docs: <a href="https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster" rel="nofollow noreferrer">securing your cluster</a></p>
</li>
</ol>
<blockquote>
<p>If I don't use certificates to protect internal communication within a cluster, how will you attract me?</p>
</blockquote>
<ol start="3">
<li>Better not do that.</li>
</ol>
<blockquote>
<p>Why are certificates not required between the load balancer and EC2, but required within a Kubernetes cluster?</p>
</blockquote>
<ol start="4">
<li><p>That's two different concepts.</p>
<p>AWS load balancer and EC2 are infrastructure-layer(Iaas) components, which are only responsible for transmitting data stream. You can enforce security options on your own.</p>
<p>On the other hand, components within a Kubernetes cluster are application-layer ones, which should include secure in-cluster communication by default.</p>
</li>
</ol>
