The Hacker’s Guide to Kubernetes
summary
Live demos show an open kubelet API and default anonymous kubelet auth allowing node-level queries, use of kubeletctl and netcat to schedule pods and establish a reverse shell, writable filesystems and containers running as root, installation of tcpdump, and an exposed Redis instance containing stolen JWTs that get replayed to hijack user accounts. Concrete fixes shown: enforce kubelet auth, run read-only non-root containers, apply network policies, and remove anonymous access to datastores.
AI-written summary · about
chapters (12)
- 0:00Introduction to Kubernetes hacking
- 2:20Kubernetes architecture overview
- 4:30OWASP top 10 Kubernetes risks
- 8:46Account hijacking demo setup
- 10:52Exploiting unsecured kubelet API
- 17:24Establishing reverse shell access
- 24:15Security issues from first demo
- 30:49Second demo hijacking accounts
- 35:27Exploiting RCE in hello app
- 38:02Redis server token theft
- 48:42Summary of second demo issues
- 51:34Key takeaways and security model
related talks
45mThe Hacker’s Guide to Kubernetes
50mThe Hacker’s Guide to Kubernetes Reloaded
46mThe Hacker's Guide to Kubernetes
55mThe Hacker's Guide to Kubernetes
51mThe Hacker’s Guide to Insecure Workload Configuration in Kubernetes
40mHacking and Hardening Kubernetes Clusters by Example [I]
31mA Hacker's Guide to Kubernetes and the Cloud
38mA Treasure Map of Hacking (and Defending) Kubernetes