Unsafe Defaults: Deploying Kubernetes Safer(ish)
summary
Kubernetes clusters frequently ship with dangerous defaults: the API binds locally on port 8080 with no TLS or auth and older controller managers speak that unauthenticated endpoint, many installs auto-munnel service-account tokens into every pod (stored world-readable, rotated only in newer versions) and insecure etcd often accepts writes on port 2379, letting an attacker push secrets cluster-wide. Quick mitigations cited are disabling anonymous access, removing auto-mounted tokens or restricting them per-namespace, enabling API bound to localhost:8080 with no TLS, using default service-account tokens mounted into every pod (chmod 777), and encrypting/protecting etcd writable on port 2379 by default.
AI-written summary · about
chapters (6)
- 0:00Intro
- 1:40What is Kubernetes
- 9:14SSL Errors
- 10:38Quick Wins
- 21:15Pod Security Policy
- 24:06Key Value Store
related talks
28mThe Path Less Traveled: Abusing Kubernetes Defaults
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era
58mTop Secret Cloud Native Security Lessons
30mFortifying Kubernetes
48mThe Path Less Traveled: Abusing Kubernetes Defaults
31mA Hacker's Guide to Kubernetes and the Cloud
35mInsights into Unsecured Kubernetes in the Wild
49mCluster Wrangling: How to make Kubernetes clusters secure and usable