Security best practices
Private endpoint — Restrict API access to your networks; pair with VPN or PrivateLink patterns.
Encryption — etcd encryption with KMS; secrets backed by KMS providers where applicable.
Pod security — Pod Security Standards / admission: non-root, read-only root FS, drop caps.
Network policies — Default deny egress/ingress where possible; explicit allow lists.
IRSA — IAM Roles for Service Accounts; short-lived creds per workload.