ANSWER

TLS traffic, API auth like certs or AD, Webhook auth mode on kubelets, Default deny policy on all inbound on all namespaces