Kubernetes Security: Attacking and Defending K8s Clusters
summary
Shows a concrete RCE against an outdated Drupal pod that leads to container escape, worker‑node takeover and cloud API key theft used to mine cryptocurrency; honeypots are compromised in under 24 hours. Demonstrates reconnaissance and exploitation with tools like kube-hunter and auditing via kube-bench, runtime detection with Falco, and policy hardening using admission controllers (Gatekeeper/Kyverno). Calls out 2,600+ exposed etcd instances and details fixes that are automatable and verifiable.
AI-written summary · about
chapters (22)
- 0:00Intro
- 1:44Awesome K8s Security List
- 2:37MITRE ATT&CK Framework ATT&C
- 3:41K8s Threat Matrix by Microsoft
- 4:20MITRE ATT&CK for Containers (and K8s)
- 6:59Initial Access
- 8:28Exploitation/Execution
- 9:13kube-hunter
- 9:51Internal Recon - Inspect the K8s env
- 11:28Post-Exploitation / Persistence
- 13:02Defending K8s
- 13:15The Kube API Server
- 14:04CIS Kubernetes Benchmark
- 16:03Image Scanning
- 19:02The Pods
- 21:02Pod Security Policy (PSP)
- 22:06PSP Replacement Alternatives
- 22:19RBAC (Role Based Access Control)
- 24:21The etcd
- 25:48The Network Policy
- 26:34The Audit Logs
- 27:39The Basics
related talks
38mKubernetes Security: Attacking and Defending K8s Clusters
38mKubernetes Security: Attacking and Defending K8s Clusters
49mAttacking and Detecting Attacks on Kubernetes Clusters
43mKubernetes Security: Attacking and Defending Modern Infrastructure
45mThe Hacker’s Guide to Kubernetes
35mKubernetes Security - Challenge and Opportunity?
19mHacking Kubernetes
31mA Hacker's Guide to Kubernetes and the Cloud