Securing Kubernetes in the Cloud
summary
Managed cloud Kubernetes (EKS/AKS/GKE) gives a usable security baseline but the most likely breach is a compromised workload that leverages mounted service account tokens, instance metadata or Helm v2/Tiller to pivot. Demo shows hands-on escalation: kubectl inside a pod reads the token, opens the Dashboard, updates the Deployment to become privileged and reaches the node; two fixes—apply network policies to block metadata and Dashboard and disable automountServiceAccountToken on pods—stop the chain. Also recommends IAM Roles for Service Accounts, helm v3, kube-bench, kube-hunter, cubescan and Falco.
AI-written summary · about
chapters (6)
- 0:00Introduction to talk
- 1:10What is Kubernetes
- 8:53Kubernetes threat model
- 15:02Protecting Kubernetes clusters
- 22:35Live security demo
- 31:10Summary and resources
related talks
43mKubernetes Security: Attacking and Defending Modern Infrastructure
46mLateral Movements in Kubernetes
33mKubernetes Security: Horror Stories to Help Secure Your Cluster
30mSecuring^WAttacking Kubernetes
53mFlying Above the Clouds: Securing Kubernetes
45mKubernetes Security: Tackling Attacks & Best Practices
36mFrom the Cluster to the Cloud: Lateral Movements in Kubernetes
37mKubernetes to Cloud Attack Vectors: Demos Inside