Vulnerability exploits too often seem like empty threats that our security teams warn us about, but not something that would ever happen to my code! Join me in this hands-on workshop, where we will walk through a remote code execution exploit and how it can be used to expand to take over an entire Kubernetes cluster along with steps you can employ that would mitigate the attack. Slides from live presentation at DockerCon, October 4, 2023

1. Hardening Against
Kubernetes Hacks
Live Demo
Eric Smalling
Sr. Developer Advocate | Snyk.io
about.me/ericsmalling

2. 2
ERIC SMALLING
● Senior Developer Advocate @ Snyk
● Based in Dallas/Fort Worth, Texas
● 20+ years enterprise software development
● 10+ years build/test/deploy automation (CI/CD)
● Docker user since 2013 (v0.6)
● 2018 Jenkins Ambassador
● Docker Captain
● CKA, CKAD & CKS Certified

3. 3
00 Section Header
Exploit
=
App Vulns + Misconfiguration

4. 4
https://github.com/snyk-labs/kubernetes-goof

5. DEMO
https://github.com/snyk-labs/kubernetes-goof

7. 7
How could we have
prevented this?
● Scan your application code
● Scan your container images
● Scan your Kubernetes YAML
● Don’t trust defaults / Be explicit
● Use Network Policies
● Use Admission Controls

8. 8
Thanks and props to :
● Mark Manning ( @antitree )
● Ian Coldwater ( @iancoldwater )
● Duffie Cooley ( @mauilion )
● Rory McCune ( @raesene )
● K8s SIG-Security
● CNCF TAG-Security
● OpenSSF
… and many others in the Kubernetes Security community.

9. THANK YOU
https://github.com/snyk-labs/kubernetes-goof
about.me/ericsmalling