Kubernetes is a portable, extensible, open source platform for managing containerized workloads and services that facilitate both declarative configuration and automation. It has a large, rapidly growing ecosystem. Kubernetes services, support, and tools are widely available.

Create a production-quality Kubernetes cluster

This page provides an overview of best practices when it comes to enforcing Pod Security Standards. Using the built-in Pod Security Admission Controller FEATURE STATE: Kubernetes v1.25 [stable] The Pod Security Admission Controller intends to replace the deprecated PodSecurityPolicies. Configure all cluster namespaces Namespaces that lack any configuration at all should be considered significant gaps in your cluster security model. We recommend taking the time to analyze the types of workloads occurring in each namespace, and by referencing the Pod Security Standards, decide on an appropriate level for each of them.

The Kubernetes API lets you query and manipulate the state of objects in Kubernetes. The core of Kubernetes' control plane is the API server and the HTTP API that it exposes. Users, the different parts of your cluster, and external components all communicate with one another through the API server.

This page provides a list of Kubernetes certified solution providers. From each provider page, you can learn how to install and setup production ready clusters.

An overview of the Pod Security Admission Controller, which can enforce the Pod Security Standards.

A Deployment manages a set of Pods to run an application workload, usually one that doesn't maintain state.

FEATURE STATE: Kubernetes v1.35 [alpha](disabled by default) Every pod group defined in a Workload must declare a scheduling policy. This policy dictates how the scheduler treats the collection of Pods. Policy types The API currently supports two policy types: basic and gang. You must specify exactly one policy for each group. Basic policy The basic policy instructs the scheduler to treat all Pods in the group as independent entities, scheduling them using the standard Kubernetes behavior.

This page provides an storage overview specific to the Windows operating system. Persistent storage Windows has a layered filesystem driver to mount container layers and create a copy filesystem based on NTFS. All file paths in the container are resolved only within the context of that container. With Docker, volume mounts can only target a directory in the container, and not an individual file. This limitation does not apply to containerd.

Concepts for keeping your cloud-native workload secure.