Kubernetes Tower Defense

on YouTube ↗39m

" summary

Live coding shows how to harden a cluster by closing real attack paths: fetching node metadata from a pod to steal service account tokens via the kubelet and metadata APIs, abusing the kube-apiserver proxy and Kubernetes CertificateSigningRequests to impersonate nodes in seconds, and reading Helm-released secret samples. Defenses demonstrated include PodSecurityPolicies and Network Policies to block node IPs, enforcing RBAC plus kubelet TLS, and using an IMDSv2 proxy/iptables shim or cloud flags to protect metadata endpoints.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 2:38Defense in Depth
3. 6:54Monitoring Tools
4. 15:34Metadata Api

" related talks

• 43mKubernetes Tower DefenseJavier Provecho · Commit Conf 2019
• 01h 37mLines of Defence – Securing Your Kubernetes ClustersHubert Ströbitzer · Craft Conference 2022
• 43mKubernetes Security: Attacking and Defending Modern InfrastructureLenin Alevski Huerta Arias, Maximillian vonBlankenburg · RSA Conference 2024
• 40mHacking and Hardening Kubernetes Clusters by Example [I]Brad Geesaman · KubeCon + CloudNativeCon North America 2017
• 01h 24mTutorial: Attacking and Defending Kube...Tabitha Sable, Jimmy Mesta, Brad Geesaman, Peter Benjamin · KubeCon + CloudNativeCon North America 2019
• 22mSecuring KubernetesNilesh Jayanandana · KCD Sri Lanka 2022
• 29mKubernetes Security: Attacking and Defending K8s ClustersMagno Logan · OWASP 20th Anniversary 2021
• 38mKubernetes Security: Attacking and Defending K8s ClustersMagno Logan · sec4dev 2021