Why would you be surprised? In most cases the only thing users need from a Kubernetes cluster is to access it from the outside... like... why wouldn't they exp

Why would you be surprised? In most cases the only thing users need from a Kubernetes cluster is to access it from the outside... like... why wouldn't they expose it to the outside world? -- this is the most useful thing you can do with it. And the range of things you might want to expose... oh, god only knows. Think about such trivial stuff as FTP or iSCSI -- kinda useful, right? -- but Kubernetes rules for port exposure are idiotic, because you cannot expose ranges. And quite a few of popular Internet protocols assume they can allocate whatever port they want and start talking on it. And then you start fighting Kubernetes... and you'll win, but it will be some custom security solution... with the obvious problem of it being a custom security solution. Now, add to this that Kubernetes will typically mess with your iptables and maybe also arptables, and if your firewall is based on eg. iptables, then you might be out of luck using it with Kubernetes, and again, will end up rolling something "special". Obviously, you might also want, say, DNS to work inside your cluster, but that's a separate can of worms.