PKI the Wrong Way: Simple TLS Mistakes and Surprising Consequences
Talkat KubeCon + CloudNativeCon North America 2020 Virtual · on Wednesday, 2020-11-18· at 17:45· Intrado Virtual Event Platform,·
summary
Kubernetes cluster misconfigurations let TLS become an attack surface: a kind cluster using HashiCorp Vault and OpenSSL allows a web pod to get a Vault CA issued system:masters cert and use curl + jq to successfully read kube-system secrets; sharing one CA lets a regular kube client cert authenticate to etcd so etcd trusted client CA enables full etcd read/write via etcdctl or HTTP; missing request‑header restrictions lets any cert assert admin identity. Fixes shown: separate standalone CAs, enable etcd auth, set client/serverAuth flags, and restrict network/CA roles.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:27Hacker agenda overview
- 1:53PKI and TLS concepts
- 5:43CA certificate abuse
- 11:11Etcd access vulnerabilities
- 16:49Front proxy authentication
- 21:29Chained CA exploits
- 28:52Mitigations and conclusion
related talks
29mKubernetes Exposed! Seven of Nine Hidden Secrets That Will Give You Pause
46mContinuous Kubernetes Security
27mUnsafe Defaults: Deploying Kubernetes Safer(ish)
31mPractical TLS Advice for Large Infrastructure
32mAchieving Mutual TLS: Secure Pod-to-Pod Communication Without the Hassle
24mOur Journey of Implementing TLS at Scale for Services on Kubernetes
28mThe Path Less Traveled: Abusing Kubernetes Defaults
31mA Hacker's Guide to Kubernetes and the Cloud