Everything Wrong with K8s Authentication and How We Worked Around It
Talkat KubeCon + CloudNativeCon North America 2021 · on Friday, 2021-10-15· at 14:30· Room 408 AB + Online·
summary
Shows precise workarounds: the system steal cluster signing key from kube-controller-manager volumes and run a privileged kube-cert-agent to mint short-lived client certificates (works on self‑hosted clusters but fails on managed control planes), and it implements an impersonation proxy built on API aggregation that pre-authorizes via SubjectAccessReviews and preserves audit actors. Notes EKS uses a proprietary OIDC path, and that certificate signing request expirationSeconds in 1.22 reduces the need for the key‑stealing hack.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:57Kubernetes OIDC Authentication
- 9:17kube-controller-manager pod exists in the control plane
- 9:32User deploys pinniped pod
- 10:01User asks Pinniped for a certificate
- 10:51Impersonation - history
- 12:14Impersonation - sudo use case
- 13:41Impersonation - abuse, cont'd
- 14:46Impersonation Proxy - full diagram
- 18:12Impersonation Proxy - implementation details
- 21:58Rancher
related talks
22mIdentity with certificates in Kubernetes
36mCertifik8s: All You Need to Know About Certificates in Kubernetes
32mStop giving root access and start securing your Kubernetes clusters instead
33mBeyond Cluster-Admin: Getting Started with Kubernetes Users and Permissions
26mSecuring Access to Kubernetes Infrastructure with Kubernetes Zero Trust Principles
31mPKI the Wrong Way: Simple TLS Mistakes and Surprising Consequences
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
41mKubernetes Auth and Access Control