As long as their cluster API servers aren't on the Internet.... which is a default for AKS, EKS, and GKE :) (there's 1.3M servers identified as Kubernetes directly on the Internet according to Shodan's latest stats).