The Insider Threat: Third-Party Applications In Your Cluster
summary
A chain of three real vulnerabilities—Kiali hard‑coded JWT secret, Fleet logging SSH keys, and an unauthenticated Longhorn API—lets an attacker go from outside the cluster to running as root on a node via a reverse shell and container escape, and those issues are patched after responsible disclosure. Recommended workflow includes Trivy and OSSF Scorecard scans, forking and hardening upstream Helm charts, automating daily vulnerability scans, GitOps deployment, and patching critical bugs within seven days.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:03Why We Need Third-Party Applications
- 3:30When Code Is Vulnerable...
- 19:19External Secrets Review
- 21:29Require Internal Ownership
- 22:36Hardening Images
- 26:52Hardening Deployments
- 28:33Walkthrough: External Secrets Configuration
- 30:55Walkthrough: The Easy Part
- 33:20Answer These Questions (Part II)
related talks
38mA Treasure Map of Hacking (and Defending) Kubernetes
19mHacking Kubernetes
29mBuilding blocks of security lifecycle management
35mKubernetes Security - Challenge and Opportunity?
33mKubernetes Security: Horror Stories to Help Secure Your Cluster
35mInsights into Unsecured Kubernetes in the Wild
58mTop Secret Cloud Native Security Lessons
46mThe Hacker's Guide to Kubernetes