Applying Least Privileges through Kubernetes Admission Controllers - Benjy Portnoy, Aqua Security
summary
Admission controllers enforce least privilege by intercepting API requests and either mutating or rejecting objects; demonstrated a dynamic admission webhook that blocks unsafe images and privileged execs. Examples include deny-escalating-exec, pod-security-policy, and image-policy-webhook; scanners shown are Kube-bench, Kube-hunter, kube-sec and Aqua MicroScanner. A live build fails with nine vulnerabilities (three critical) detected by MicroScanner, and demos show blocking untrusted images and preventing host-path and privilege escalations.
AI-written summary · about
chapters (27)
- 0:00Intro
- 1:02Aqua Security Breach
- 2:14Who Read This Book
- 3:04Tesla Example
- 3:45Why are Kubernetes clusters being hacked
- 4:16The issue with Kubernetes
- 5:09Social engineering attacks
- 5:43Example
- 6:54Kubernetes best practices
- 7:47Kubernetes Admission Controller
- 8:22Kubernetes Admission Controller Graph
- 8:44Why do you need them
- 10:38Kubernetes 110
- 10:57Layered Security
- 12:14Always Pull Images
- 13:10Deny Escalating exec
- 14:00What security policy is available
- 15:29Hackie things
- 16:53Node restriction
- 17:22Fork bomb
- 18:33Resource quota
- 19:05Image policy
- 19:53Example of image policy
- 20:54QBench
- 21:30CIS Benchmark
- 23:19Aqua Micro Scanner
- 25:54Demo
related talks
34mPrinciple of Least Privilege: How to Secure Kubernetes Without Making Users Hate You
31mSafeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring
28mClosing the Loop: Applying Least Privilege and Ensuring We Did It Well
28mKubernetes Security Low-Hanging Fruit
41mKubernetes Security Jumpstart
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
20mUsing, and mis-using K8s Dynamic Admission Control
43mKubernetes Security: Attacking and Defending Modern Infrastructure