Oh No Our Kubernetes Cluster Has Been Compromised!Will YOU Save the Day?
summary
Cluster alert surfaces via Tetragon eBPF alert in Grafana/Prometheus showing a chroot process inside a kube-controller-manager pod on EC2 nodes; investigation of audit logs ties activity to a compromised admin token. A Kyverno policy blocks allowPrivilegeEscalation and prevents new privileged pods in a demo, but attacker persists by writing directly to etcd using a stolen server certificate with loose file permissions. Recommended fixes: rotate tokens and certs, enable audit logging and etcd encryption at rest, run CIS benchmarks.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:25Agenda
- 2:51Cloud-native security basics
- 4:20Compromised cluster alert
- 7:13Investigating with Tetragon
- 10:04Suspicious controller manager
- 12:17Audit logs for accounts
- 14:09Mitigating with Kyverno
- 16:01Privilege escalation path
- 17:26Kyverno bypass troubleshooting
- 19:11etcd manipulation bypass
- 21:49CIS Benchmark hardening
- 23:14Monitoring etcd with Tetragon
- 25:01Daily security practices
- 27:51MITRE ATT&CK for containers
- 28:54Kubernetes CVEs and attack surface
- 29:38Q&A
related talks
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
01h 37mLines of Defence – Securing Your Kubernetes Clusters
33mKubernetes Security: Horror Stories to Help Secure Your Cluster
29mKubernetes Security: Attacking and Defending K8s Clusters
50mBeyond the Pod: Privilege Escalation in Kubernetes
33mTutorial: Hack My Mis-Configured Kubernetes
22mSecurity Showdown: The Overconfident Operator Vs the Nefarious...
38mKubernetes Security: Attacking and Defending K8s Clusters