What Doesn’t Kill You Makes You Stronger: The Vulnerabilities Th...
summary
Five concrete Kubernetes failures get decoded: an API-aggregation upgrade tunnel authentication bypass that lets proxied requests skip auth, a RBAC/CRD scope confusion leading to cluster-level changes, the infamous runC CVE-2019-5736 file‑mapping escape, the CRI‑O cr8escape unsafe sysctl injection, and an externalIP routing feature that enables traffic hijack. Each case shows which boundary breaks, which control stopped it (private API endpoints, nonroot containers, user namespaces, admission policies, deny externalIPs, runtime monitoring), and the claim that stacked controls — not fast patching alone — drastically reduce exploit impact.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:29Kubernetes cluster boundaries
- 3:34API aggregation 2017 flaw
- 8:12Container escape via runC
- 13:54RBAC bypass via CRD scope
- 17:20External IPs multi-tenancy flaw
- 20:51CR IO unsafe CCTL flaw
- 23:19Hardening controlled components
- 25:47Simplifying Kubernetes security
related talks
35mKubernetes Security - Challenge and Opportunity?
34mCrafty Requests: Deep Dive Into Kubernetes CVE-2018-1002105
49mAttacking and Detecting Attacks on Kubernetes Clusters
29mKubernetes Exposed: One Yaml Away from Disaster
38mKubernetes Security: Attacking and Defending K8s Clusters
33mKubernetes Security: Horror Stories to Help Secure Your Cluster
29mHarder than You Think: Native Security in Kubernetes
29mKubernetes Security: Attacking and Defending K8s Clusters