Kubernetes Exposed! Seven of Nine Hidden Secrets That Will Give You Pause
Talkat KubeCon + CloudNativeCon North America 2021 · on Wednesday, 2021-10-13· at 14:30· Concourse Hall 151 + Online·
summary
Kubernetes defaults bite: individual TLS certs can’t be revoked so you must rebuild CA chains; Kubernetes disables Docker’s seccomp defaults unless cluster and kubelet flags are both set; the hard-coded system:masters binding remains privileged even after deletion. Validating webhooks can leak payloads (used to exfiltrate ~1 MB secret carrier to an external server) and act as a side channel; DNS tunneling with dnscat C2 works over UDP 53 despite network policies; ExternalIP services can redirect control‑plane traffic and a 30–90s race lets a scaled nginx + ExternalIP trick cause a validating webhook to fail open and yield root.
AI-written summary · about
chapters (7)
- 0:00Introduction and certificates
- 2:50Second security configuration
- 4:15System:masters vulnerability
- 7:00Data exfiltration techniques
- 11:41DNS tunneling and exfiltration
- 18:45Service redirection attack
- 27:37Conclusion and resources
related talks
29mKubernetes Exposed: One Yaml Away from Disaster
31mPKI the Wrong Way: Simple TLS Mistakes and Surprising Consequences
58mTop Secret Cloud Native Security Lessons
27mWhat Doesn’t Kill You Makes You Stronger: The Vulnerabilities Th...
46mContinuous Kubernetes Security
27mUnsafe Defaults: Deploying Kubernetes Safer(ish)
40mHacking and Hardening Kubernetes Clusters by Example [I]
46mThe Hacker's Guide to Kubernetes