[raesene9]

Also Kubeadm has a pretty sane set of default security settings, which some other k8s distributions do not.

Specifically kops (by default) does not enable authentication on the kubelet, meaning any attacker who gets access to one container in your cluster is very likely to be able to compromise the whole thing.