Kubernetes Security: Horror Stories to Help Secure Your Cluster
summary
Examines two real Kubernetes security incidents and their fixes: an externally exposed dashboard behind a public load balancer that allowed anyone to launch privileged pods (a stealth miner ran until the service was internalized), and EKS nodes using IMDSv1 that leaked userdata, kube bootstrap certificates and temporary AWS credentials enabling full cluster takeover—fixed by enabling IMDSv2 and locking the kube-apiserver endpoint. Shows concrete tooling and checks (Popeye), policy enforcement with Gatekeeper, and network controls (NetworkPolicy and CNI choices) to detect and prevent such issues.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:30Kubernetes basics
- 3:18Protecting the API
- 8:35RBAC authentication
- 15:22Container runtime security
- 20:18Exposed service horror story
- 25:21EKS IMDSv1 vulnerability
- 30:00Auditing tools
- 31:47Closing
related talks
34mKubernetes Security 101: Best Practices to Secure Your Cluster
43mKubernetes Security: Attacking and Defending Modern Infrastructure
29mKubernetes Security: Attacking and Defending K8s Clusters
33mSecuring Kubernetes in the Cloud
35mKubernetes Security - Challenge and Opportunity?
45mKubernetes Security: Tackling Attacks & Best Practices
35mInsights into Unsecured Kubernetes in the Wild
38mKubernetes Security: Attacking and Defending K8s Clusters