Trampoline Pods: Node to Admin PrivEsc Built Into Popular K8s Plat...
summary
Research shows popular K8s platforms initially ship powerful daemonset trampoline pods on 62.5% of distributions; after disclosure that drops to 25%. Attack reproduces cleanly: escape to node, use node-status update to mark other nodes unschedulable, delete an operator pod so it reschedules onto the compromised node, steal its service account token, then modify ClusterRoleBindings to become cluster-admin. A detection tool rbac-police is released and demos work; affected projects (e.g. Cilium) push fixes.
AI-written summary · about
chapters (20)
- 0:00Start
- 1:12Abstract
- 1:53Container Escapes - An Inevitable Reality
- 2:42Obvious Impact: Compromised Node
- 3:27Terminology
- 3:54Credentials on a Rogue Node
- 5:45Trampoline Pods
- 7:25Daemon Sets vs Non-Daemon Sets
- 11:27What Makes a Pod Bouncy?
- 12:36Analyzed Platforms
- 13:28Container Escape == Cluster Admin? (Feb)
- 13:49Escape == Admin (Feb 22)
- 15:14Cillum: Trampolines
- 15:39Attack Walkthrough
- 21:34Attack Classes in Demo
- 21:59Final Remarks on Cilium
- 22:45Disclosure & Fixes
- 23:43Trampolines Daemon Sets
- 24:52Recommendations for Users & Projects
- 28:43Final Thoughts
related talks
29mKubernetes Security: Attacking and Defending K8s Clusters
50mBeyond the Pod: Privilege Escalation in Kubernetes
32mKubernetes Attack and Defense: Inception-Style
38mKubernetes Security: Attacking and Defending K8s Clusters
38mKubernetes Security: Attacking and Defending K8s Clusters
44mStranger Danger - hack my misconfigured Kubernetes
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
36mFrom the Cluster to the Cloud: Lateral Movements in Kubernetes