Securing the Kubelet API: Why is it important?
summary
Kubelet API misconfiguration lets an attacker list node pods, read container logs and even exec commands remotely; the demo uses a one‑node k3s cluster on GCP, plain curl and a community kubeletctl (CyberArk) demo to show it. The live system runs with Port 10250 exposed and anonymous login enabled plus AlwaysAllow authorization so curl returns running pods, logs and a writable file inside a container. Fix by firewalling 10250 and enforcing auth.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker intro
- 1:47Kubernetes architecture overview
- 3:10What is the Kubelet API
- 4:58Security risks of open Kubelet API
- 6:44Live demo of exposed Kubelet API
- 10:40Security recommendations for Kubelet
- 11:22Q&A and closing remarks
related talks
01h 24mTutorial: Attacking and Defending Kube...
54mThe Hacker’s Guide to Kubernetes
30mSecuring^WAttacking Kubernetes
40mHacking and Hardening Kubernetes Clusters by Example [I]
45mThe Hacker’s Guide to Kubernetes
01h 37mLines of Defence – Securing Your Kubernetes Clusters
45mKubernetes Runtime Security
31mA Hacker's Guide to Kubernetes and the Cloud