Control planes should be separated from what they control
The system that manages your infrastructure should not be reachable from the infrastructure it manages.
Otherwise compromising one workload gives access to the thing that controls all workloads, which converts a contained incident into a total one. It is the same principle as tiered administration, applied to orchestration platforms, cloud management and configuration systems.
More on Architecture patterns
- A jump host concentrates administrative entryOne plank, every crossing
- A bastion should not become a general-purpose workstationIt only has the one job
- Bulkheads contain failureThe water stops at the wall
- Out-of-band management survives primary-path failureWhen the bridge is out
- A choke point makes control observableEverything through one gap
- A broker can separate clients from powerful credentialsChained to the bench