Kubernetes RBAC Security: A Practical Overview
summary
Shows practical Kubernetes RBAC security issues: public API endpoints can reveal version/health and, if misconfigured, allow listing of pods, secrets and privileged containers; a Shodan scan found about 81,000 exposed clusters. Demonstrates an anonymous user being escalated to admin by adding permissions, then runs open-source scanners plus a small custom script (repo published) to detect who can access pods or secrets, highlighting gaps where some tools miss misconfigurations in roles, rolebindings and serviceaccounts.
AI-written summary · about
chapters (12)
- 0:00Welcome
- 1:09Speaker background
- 3:23RBAC and security importance
- 6:29Key RBAC components
- 8:39Cloud RBAC relevance
- 12:57Least privilege principle
- 13:35Kubernetes RBAC specifics
- 18:19API exposure risks
- 21:51Default permissions
- 24:45Permission management challenges
- 27:15RBAC audit tools
- 29:01Conclusions
related talks
35mRBAC to the Future: Untangling Authorization in Kubernetes
49mCompromising Kubernetes Cluster by Exploiting RBAC Permissions
33mHow the Basics Of Kubernetes Auth Scale For Organizations
25mMastering K8s Security
32mStop giving root access and start securing your Kubernetes clusters instead
56mRBAC 101: Basics, Misconceptions, and the Real World
34mKubernetes Security 101: Best Practices to Secure Your Cluster
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes