Take a look at Openshift Origin for pointers. Mandatory TLS at all levels, SELinux is required with a policy to match, OVS based SDN with a multi tenant plugin

Take a look at Openshift Origin for pointers. Mandatory TLS at all levels, SELinux is required with a policy to match, OVS based SDN with a multi tenant plugin preventing k8s namespaces (projects in Openshift speak) from talking to each other at the network layer, etc. Security is the primary feature of Openshift