Fuzzing and Testing the Security of Kubernetes Admission Controllers
summary
A schema-driven fuzzer downloads CRD schemas, generates around 160 manifests/sec, and runs until a configured 250-error stop, exercising Admission webhooks by sending randomized but structured manifests. It finds concrete bugs — an integer cast on zipcode crashes the webhook — and shows the real risk: with failurePolicy=Ignore that crash lets malformed resources be persisted, producing operator crashes or node instability. The tool runs end‑to‑end against a live cluster and reproduces the failures.
AI-written summary · about
chapters (27)
- 0:00Talk introduction
- 0:21Speaker background
- 1:26Agenda overview
- 2:28Kubernetes basics
- 3:51Custom Resource Definitions
- 5:36Admission controllers explained
- 7:00Security implications
- 8:04Use cases
- 9:08Custom resource validation
- 10:34Fuzz testing introduction
- 11:37Fuzzer types
- 12:39Fuzzing approaches
- 13:00Fuzzing tools
- 14:02Fuzzing admission controllers
- 15:30Fuzzer design
- 17:59Demo blocking privileged containers
- 21:59Translating controllers to fuzzing
- 23:44Finding validation vulnerabilities
- 25:08Setting up fuzzer
- 28:30Running fuzzer and results
- 30:20Fixing failure policy
- 31:43Analyzing fuzzer output
- 32:47Manual vulnerability demo
- 33:52Bypassing failure policy
- 35:24Future fuzzing plans
- 36:49Testing Operator Hub security
- 37:31Closing remarks and Q&A
related talks
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically
53mFuzz Testing for Fun and Profit
26mHacking into Kubernetes Security for Beginners
26mBoost your security and resiliency in Kubernetes
27mA Safari of Kubernetes and its Natural Habitat
29mKubernetes Security: Attacking and Defending K8s Clusters
35mHow to fight misconfiguration and bad intentions with Kubernetes admission policy
38mKubernetes Security: Attacking and Defending K8s Clusters