Comment by parasubvert

Kubernetes has no inherent or required proxies or sidecars or ingresses, or TLS re-encryption points.

Those are added by “application architects”, or “security architects” and existed long before Kubernetes, for the same debatable reasons: they read about it in a book or article and thought it was a neat idea to solve a problem. Unfortunately, they may not understand the tradeoffs deeply, and may have created more problems than were solved.