Hacking and Hardening Kubernetes Clusters by Example [I]
summary
Live-recorded demos show how a container shell plus five curl/bash commands and a mounted default service account token or an exposed kubelet can dump secrets, pull IAM/GCP tokens from the metadata API 169.254.169.254, and escalate to root by scheduling a privileged hostPath pod and adding an SSH key. Tools used: kubectl, kubelet/cadvisor endpoints, Kubernetes dashboard, Redis CLI, curl, bash. Mitigations shown: network policy, metadata proxy, kubelet webhook auth, and Kubernetes 1.8+ pod security and egress controls.
AI-written summary · about
chapters (42)
- 0:00Introduction
- 0:35About Brad
- 1:15Installing Kubernetes Clusters
- 1:46Takeaways
- 2:32Goals
- 3:06Defaults
- 3:30Inertia
- 3:46Security Capability Gap
- 4:55Additional Security Hardening
- 5:30Challenges
- 6:23Attack Driven Harding
- 6:38Progressive Steps
- 7:08The External Attacker
- 8:15Teaching in Admin
- 8:45CoopControl
- 9:01Attack Structure
- 9:24Install Custom Tools
- 9:55Insecure Bind Address
- 11:34Service Account Token
- 12:23Kubernetes Dashboard
- 13:23Vote
- 14:19Couplet
- 16:50Scheduling a Pod
- 18:07Metadata API
- 18:37AWS Keys
- 19:45IAM Permissions
- 20:41EC2 Star
- 21:21GKE
- 23:51API
- 27:07Metadata Proxy
- 28:16Network Policy
- 28:34Pod Selector
- 29:07Back and Node Restrictions
- 29:31Supporting Egress
- 30:13Vulnerability disclosure
- 30:40CoOpTBF
- 30:57Sonobuoy
- 31:19Security Hardening Tips
- 32:19Network Security Policy
- 32:58Default Deny Policy
- 35:06Tools
- 35:45Whitelisting
related talks
30mSecuring^WAttacking Kubernetes
19mHacking Kubernetes
01h 13mTutorial: Hands-on Hacking Kubernetes and Ways to Prevent It
31mA Hacker's Guide to Kubernetes and the Cloud
50mThe Hacker’s Guide to Kubernetes Reloaded
43mKubernetes Security: Attacking and Defending Modern Infrastructure
38mA Treasure Map of Hacking (and Defending) Kubernetes
55mThe Hacker's Guide to Kubernetes