Protecting workloads in Kubernetes involves securing multiple components of the cluster. Vulnerabilities in your base OS or non-OS packages that developers use to build applications can be exploited. This requires image scanning and integrating via admission controllers to prevent risky image deployments. Another component to secure is your Kubernetes control plane (i.e., controller manager, etcd), which can be accessed via the Kubernetes API, and requires security monitoring and auditing of all activity happening at the API server level.