The Devil in the Details: Kubernetes’ First Security Assessment
Talkat Cloud Native Security Day 2019 · on Monday, 2019-11-18· at 15:35· Marriott Marquis San Diego Marina - San Diego Ballroom A, 333 W Harbor Dr·
summary
Kubernetes undergoes a yearlong third‑party audit that produces 241 pages of reports, an attackers guide, an operator white paper, and a threat model covering eight components across six trust zones. Trail of Bits and Atredis Partners run code review and pentests and report 37 CVEs including non‑authenticated HTTP, missing certificate revocation, pod security policy bypasses, token and credential leakage to node logs, and container runtime/volume weaknesses. Recommendations focus on least‑privilege controllers, a unified audit trail, hardened defaults, and reusable libraries to avoid repeated insecure implementations.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:39Smarter WG Co-Leads
- 3:06Ecosystem
- 5:41Philosophy
- 8:58Components to the Assessment
- 10:15Attacks on Kubernetes
- 13:44An Attacker's view of Kubernetes
- 21:43Threat Model - Highlights
- 24:58Source Assessment - Highlights
- 28:44Call for Action
- 32:13Questions?
related talks
36mThe Devil in the Details: Kubernetes’ First Security Assessment
39mPiloting Around the Rocks: Avoiding Threats in Kubernetes
19mHow to Secure Your Kubernetes Clusters
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era
35mKubernetes Security - Challenge and Opportunity?
11mKeynote: Securing Kubernetes, the Upstream Way
34mKubernetes Security 101: Best Practices to Secure Your Cluster
43mKubernetes Security: Attacking and Defending Modern Infrastructure