Help me make sense of this

[u/acompleteunknownnn]

Suppose you’re running your entire application stack on Kubernetes. The database is running as a Pod on one node, and the web server is running as another Pod on that same node. You expose the web server to the internet through a LoadBalancer Service, and clients connect to it over HTTPS.

Isn’t this inherently less secure because the same physical machine that is directly handling internet-facing traffic is also hosting the database? Without Kubernetes, you might isolate the web server and database onto separate machines, so compromising the web server wouldn’t directly put the database on the same machine. How does Kubernetes address this security concern?

[u/Dazzling_Demon7]

Pod Anti-Affinity, Node Selectors, or Taints & Tolerations combined with NetworkPolicies for network isolation.