A Kubernetes operator is software that automates the deployment, configuration, scaling, and lifecycle management of an application inside a Kubernetes cluster. It works by watching the cluster for changes and then reconciling the running state with the desired state defined by the operator’s logic.
In cyber security, operators matter because they often run with elevated permissions and can control critical infrastructure components. If an operator is vulnerable or misconfigured, an attacker may use it to change workloads, expose services, or interfere with updates and secrets handling. Defenders also rely on operators for the same reason: they can enforce secure defaults, roll out patches consistently, and reduce manual errors. In practice, security teams should treat both the operator and the applications it manages as part of the attack surface, because compromise of either can affect the whole cluster.