Breaching the sky’s limit on your cloud: privilege escalation in Kubernetes
summary
Demonstrates a concrete Kubernetes privilege escalation: using microk8s launched via multipass and a BusyBox container to schedule a pod onto a control-plane node, read filesystem-mounted certs, exfiltrate kube-apiserver certificates, craft a CSR and impersonate a cluster identity, then create roles and delete namespaces. Shows which defaults enabled the attack (scheduler/node taints, writable cert dirs, permissive RBAC) and practical fixes: tighten RBAC, enable PodSecurity/PSPs, use admission controllers, avoid privileged containers and verify container user/image settings.
AI-written summary · about
chapters (9)
- 0:00Kubernetes security risks
- 1:29Kubernetes misconceptions
- 2:54MicroK8s with Multipass setup
- 3:59RBAC permissions setup
- 6:49Privilege escalation via scheduling
- 8:54Certificate access exploits
- 9:36Kubernetes cluster protection
- 11:42Kubernetes security updates
- 12:26Closing remarks
related talks
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
50mBeyond the Pod: Privilege Escalation in Kubernetes
36mFrom the Cluster to the Cloud: Lateral Movements in Kubernetes
43mKubernetes Security: Attacking and Defending Modern Infrastructure
53mFlying Above the Clouds: Securing Kubernetes
30mSecuring^WAttacking Kubernetes
48mThe Path Less Traveled: Abusing Kubernetes Defaults
34mHijack a Kubernetes Cluster - a Walkthrough