Three Surprising K8s Networking “Features” and How to Defend Against Them
summary
Nmap and OpenSSL enumeration reveals API server certificate SANs that leak the service network CIDR, and unauthenticated /version and UDP scans find kubelet, vxlan (4789) and CoreDNS endpoints. Proof‑of‑concept scripts (Scapy, curl, bash /dev/tcp, kubeletctl) demonstrate asymmetric routing via IP‑in‑IP and VXLAN to reach pod and service IPs from an adjacent bastion; VXLAN requires a leaked VTEP and usually VNI=1. Mitigations shown: isolate bastions, strict firewall rules, network policies, rp_filter/ip spoofing protections; PoCs work in lab and code is on GitHub.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:50Cluster reconnaissance
- 7:36Abusing layer 2 primitives
- 15:10IPIP overlay network attacks
- 21:14VXLAN exploitation
- 27:06Defense and mitigation
related talks
40mAttacking Kubernetes Clusters Through Your Network Plumbing
34mIt's Not Always the Network (But Here's How to Prove It): Kubernetes Packet...
43mKubernetes Security: Attacking and Defending Modern Infrastructure
19mHacking Kubernetes
49mAttacking and Detecting Attacks on Kubernetes Clusters
27mDeconstructing K8s Networking for Knowledge and Profit
38mKubernetes Security: Attacking and Defending K8s Clusters
38mKubernetes Security: Attacking and Defending K8s Clusters