The Hitchhikers Guide to Container Security
Talkat KubeCon + CloudNativeCon North America 2021 · on Thursday, 2021-10-14· at 17:25· Petree Hall C + Online·
summary
Demo shows a privileged Pod using hostPID and hostNetwork plus a hostPath mount of /etc/kubernetes on a control-plane node to read admin.conf and drop a kubelet-managed “incognito” pod invisible to the API, proving a real node escape and persistent backdoor. The remedy is OPA Gatekeeper: they install constraint templates and constraints that deny privileged containers and dangerous host paths, then demonstrate kubectl rejects those manifests and the attack is prevented.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:29The Story
- 2:40The Node
- 6:21Demo
- 6:58Poly Manifest
- 10:30Poly Namespace
- 17:09Oprah Gatekeeper
- 18:27Deploying Oprah
- 24:56Conclusion
related talks
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
30mSecuring^WAttacking Kubernetes
50mBeyond the Pod: Privilege Escalation in Kubernetes
43mKubernetes Security: Attacking and Defending Modern Infrastructure
50mThe Hacker’s Guide to Kubernetes Reloaded
26mHacking into Kubernetes Security for Beginners
54mThe Hacker’s Guide to Kubernetes
48mThe Path Less Traveled: Abusing Kubernetes Defaults