This document is a presentation by Patrycja Wegrzynowicz on Kubernetes security, including an overview of its architecture and the OWASP Kubernetes Top 10 vulnerabilities. It offers demonstrations of hacking scenarios to illustrate the risks associated with misconfigurations, inadequate logging, and insecure workloads. The session emphasizes the importance of continuous learning in maintaining security within Kubernetes environments.

1. The Hacker’s Guide to Kubernetes
Patrycja Wegrzynowicz
Form3

2. ● 20+ professional experience
– software engineer, architect, researcher, head of R&D
● Author and speaker
– JavaOne, CodeOne, Devoxx, JFokus, JavaZone, and
more
● Top 10 Women in Tech in Poland
● Oracle Groundbreaker Ambassador
● Form3, Financial Cloud
– Lead Engineer
● Founder at Yon Labs
– Automated tools for detection and refactoring of software
defects.
– Performance, security, concurrency.
You can insert a picture here!
Hi!

3. Form3, Financial Cloud
● Business Model
– Provides a payment platform for financial institutions
– Integrates across multiple payment schemes
– Makes integration easier and quicker
● Work Model
– Fully remote
– Pair programming
● Technology
– Cloud based
– Microservices
– Infrastructure as Code

4. Agenda
● Introduction to Kubernetes Architecture
● Introduction to OWASP Kubernetes Top 10
● Demos
● Summary

5. Introduction to Kubernetes
Architecture

6. Kubernetes Components
Source: https://medium.com, Kubernetes - Architecture Overview by Ashish Patel

7. Introduction to OWASP
Kubernetes Top 10

8. OWASP Kubernetes Top 10
K01 Insecure Workload Configuration
K02 Supply Chain Vulnerabilities
K03 Overly Permissive RBAC Configurations
K04 Lack of Centralized Policy Enforcement
K05 Inadequate Logging and Monitoring
K06 Broken Authentication Mechanisms
K07 Missing Network Segmentation Controls
K08 Secrets Management Failures
K09 Misconfigured Cluster Components
K10 Outdated and Vulnerable Kubernetes Components

9. Demos

10. Let the fun begin! Demos!
● Demo application
– https://cdc.yonlabs.com
– Register an account
– Each account has its secret
– Log in
– Wait to be hacked!
● Objective
– to hack your accounts and learn your secrets

11. Demo #1

12. Demo #1 - Open Kubelet API

13. Demo #1 - Vulnerabilites
● Open kubelet API
– K09 Misconfigured Cluster Components
● Containers: writable filesystem
– K01 Insecure Workload Configuration
● Containers: run as root
– K01 Insecure Workload Configuration
● Containers: quite a few tools available
– reverse shell possible
● Networking: unencrypted traffic
● Networking: open egress to Internet

14. Swiss Cheese Model

15. Demo #2

16. Demo #2 – RCE & Network
● Remote Code Execution
● Missing Network Segmentation
– Pods able to connect to unrelated pods in a different namespace

17. Demo #2 - Vulnerabilites
● RCE in one (!) Kubernetes deployment
– K10 Outdated and Vulnerable Components
● Missing network segmentation
– K07 Missing Network Segmentation Controls
● Containers: quite a few tools available
– reverse shell possible
● Anonymous access to Redis

18. OWASP Kubernetes Top 10

19. K01 Insecure Workload Configuration
● Application process should not run as root
● Read-only filesystems should be used
● Privileged containers should be disallowed

20. K02 Supply Chain Vulnerabilities
● Image integrity
● Image composition
● Known software vulnerabilities

21. K03 Overly Permissive RBAC
● Role-Based Access Control as a primary authorization mechanism
● Unnecessary use of cluster-admin
● Too wide permissions
● Automatically mounted tokens

22. K04 Lack of Centralized Policy Enforcement
● Distributing and enforcing security policies across multiple clusters, clouds, and risk
tolerances quickly becomes unmanageable for security teams.
● Detecting is not enough
● Should be blocked
● e.g. untrusted registries

23. K05 Inadequate Logging and Monitoring
● Relevant events such as failed authentication attempts, access to sensitive
resources, manual deletion or modification of Kubernetes resources are not
logged.
● Logs and traces of running workloads are not monitored for suspicious activity.
● Alerting thresholds are not in place or escalated appropriately.
● Logs are not centrally stored and protected against tampering.
● Logging infrastructure is disabled completely.

24. K06 Broken Authentication Mechanisms
● Human authentication
– OpenID Connect, Certificates, Cloud IAM, ServiceAccount tokens
● Service Account Authentication
– Should be configured with RBAC

25. K07 Missing Network Segmentation
● Kubernetes flat network model
● Multi-cluster – cluster segmentation
● Network policies

26. K08 Secrets Management Failures
● Kubernetes secret - a small standalone object containing sensitive data like
passwords, tokens
● Leaking kubernetes secrets
● Encryption at rest
● Addressing security misconfiguration

27. K09 Misconfigured Cluster Components
● Kubelet – anonymous-auth, authorization mode
● Etcd
● Kube-apiserver

28. K10 Vulnerable Kubernetes Components
● ArgoCD CVEs
– CVE-2022-24348
– allows to load malicious helm charts
● Kubernetes CVEs
– CVE-2021-25742
– Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all
namespaces
● Istio
– CVE-2020-8595
– authentication bypass
● Many others!

29. Summary

30. Kubernetes Security

31. Swiss Cheese Model

32. A fool with a tool is only a fool

33. Continuous Learning

34. Q&A
@yonlabs

35. Thank You!