CSI Volume Attacks – The SRE Strikes Back
summary
Shows concrete exploits and defenses for CSI volumes using a NetApp Trident demo: how claimRef protection on PVs prevents cross-namespace reuse, how inline NFS/ iSCSI mounts bypass PVCs and are blocked by PodSecurityPolicy + RBAC, and how setting securityContext with fsGroupChangePolicy avoids slow recursive chowns (recursive fixes can take minutes on large filesystems). Recommends NFSv4, root_squash, iSCSI CHAP and driver-managed export/initiator lists, plus resource quotas and limitRanges to cap namespace storage.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:16focusing on dynamic storage provisioning with the container
- 1:50integrate different storage solutions into kubernetes
- 3:32look into limiting access to a storage class
- 5:19check the underlying pv
- 9:20prevent pods from running as root
- 11:46set the security context
- 12:42apply different permissions to the volume
- 16:11apply limits for each individual volume
- 17:03use standard protocols such as nfs or iscardia in the background
- 20:51make use of resource quotas
related talks
29mCF Volume Services - Building for Failure, Security and Performance
34mExploiting a Slightly Peculiar Volume Configuration with SIG-Honk
22mSecuring Kubernetes
01h 37mLines of Defence – Securing Your Kubernetes Clusters
27mSurviving Day2 : Picking the Right Tool To Secure Your Kubernetes Habitat
49mAttacking and Detecting Attacks on Kubernetes Clusters
29mSecuring Container Runtimes -- How Hard Can It Be?
38mKubernetes Security: Attacking and Defending K8s Clusters