Module 5 · Kubernetes — The Platform That Multiplies Attack Surface 🔒

Kubernetes is a platform that runs other platforms. Complexity = attack surface. Every component — kubelet, API server, etcd, CoreDNS, service mesh proxies, ingress controllers, admission webhooks, operators — has its own attack surface. Misconfigurations span identity (RBAC), network (policies), workload (pod security), supply chain (images), and runtime (privilege escalation from pod).

Why K8s is complex to secure

• Default permissive — ServiceAccount tokens mounted into every pod, default namespace has broad defaults
• Every namespace is a boundary; not every team treats them as one
• RBAC has many verbs and resources; compound permissions unclear
• Admission controllers need careful configuration to prevent bypass
• Runtime privilege escalation paths exist for pods (hostPath mounts, privileged containers, CAP_SYS_ADMIN)
• Mesh side-car containers bypass many pod-level controls

Common attack patterns

Pod → Node → Cluster

# Compromised pod with hostPath mount
# Attacker writes to /host/etc/cron.d/evil
# Cron on node executes attacker code as root
# Node credentials (kubelet) accessed → cluster-wide access

# Privileged pod
# securityContext.privileged: true → full access to host
# CAP_SYS_ADMIN → mount operations → read any host file

# Host network
# hostNetwork: true → pod uses host's network namespace
# Can reach services otherwise network-policy-restricted

Service account abuse

# Inside compromised pod
cat /var/run/secrets/kubernetes.io/serviceaccount/token
# Use this with kubectl
curl -k https://kubernetes.default.svc/api/v1/namespaces \
    -H "Authorization: Bearer $(cat /var/run/secrets/.../token)"

# If service account has cluster-admin (common default in older tutorials):
# Full cluster access from compromised pod

Exposed kubelet

Kubelet port 10250 with anonymous auth enabled = direct pod execution on every node. Older installations had this; current kubeadm disables by default but legacy clusters remain.

Exposed etcd

etcd contains all cluster state including secrets (sometimes encrypted at rest, sometimes not). Reachable from inside cluster by default; sometimes externally. Compromise = full secret extraction.

# Check own permissions
kubectl auth can-i --list

# Find over-permissive bindings
kubectl get clusterrolebindings -o yaml | grep -B5 cluster-admin

# Recon tool
kube-hunter --remote KUBERNETES-IP
peirates   # interactive K8s attack framework