Hacking and Securing Kubernetes Clusters

Explore how Kubernetes, an open source container orchestration platform by Google, manages containerized workloads with declarative configuration and automation, DNS-based container interactions, load balancing, automated rollouts, and self-healing.

Set up the lab for hands-on exercises and introduce the core concepts of Kubernetes to build a foundation for the remaining modules.

Set up a local, hands-on lab for hacking and securing Kubernetes clusters by configuring three virtual machines with shadowbox, an attacking machine and a worker node, and downloading required images.

The instructor demonstrates a three-node Kubernetes lab setup, detailing RAM configuration and a naming convention (master, worker one, Gartley), with machines left fresh for installation.

Set up a Kubernetes cluster on virtual machines with a bridge adapter. Install Docker, initialize the master node, deploy a CNI like Flannel, and join the worker node.

Verify the local cluster setup by ensuring the master node is configured and every node is online, then confirm with kubectl get nodes to proceed.

Explore core Kubernetes terms—cluster with master node and control plane, worker nodes, parts containing containers, namespaces, services as load balancers, and deployments that specify replicas of Docker images for uptime.

Explore the Kubernetes control plane and node components, including the API server, scheduler, controller manager, etcd (Xindi), kubelet, and kube-proxy, and learn how they manage cluster state and services.

Deploy the vulnerable Wonderwall web app on a Kubernetes cluster using four yaml files, expose it via nodeport, and explore attacker footholds, misconfigurations, and remediation.

Use kubectl to list nodes, pods, and services, view cluster configurations, and create or delete pods, deployments, and services. Access logs and run shells on running pods for troubleshooting.

Learn to hack and secure Kubernetes clusters by gaining an initial foothold, then fully compromising the cluster. Examine misconfigured API, storage, and dashboards, with post-exploitation enumeration.

Explore the Kubernetes attack surface, including external attackers, exposed API server, compromised containers, and malicious insiders, and learn how misconfigurations can lead to cluster compromise.

Explore role based access controls in Kubernetes, distinguishing namespace roles from cluster roles, and using role bindings and cluster role bindings to grant per-subject permissions on resources with specific verbs.

Show how to create a namespace, a service account, and a role binding to enforce role-based access controls with namespace-scoped permissions and cluster roles for cross-namespace access.

Create a cluster role and cluster role binding to let a service account list parts across the cluster beyond a single namespace, demonstrating cross-namespace access and pen testing setup.

Introduce a deliberate Kubernetes misconfiguration by creating a cluster role binding and service account, then deploy and clean up an application to demonstrate risks and post-exploitation implications.

Perform a basic network penetration test of a Kubernetes cluster with Nmap, scanning master and worker nodes, recording service ports, and evaluating open ports for potential misconfigurations.

Learn how a remote code execution vulnerability in a flask API can give an attacker an initial foothold in a Kubernetes cluster by abusing unsanitized user input to execute commands.

Perform post-exploitation enumeration to determine the target kubernetes cluster, inspect environment variables and mount points, and gather details for further information gathering.

Post exploitation enumeration shows accessing the Kubernetes API server, querying pods in the default namespace with a service account token, and transferring tools onto the compromised container.

Demonstrate post exploitation in a Kubernetes cluster by downloading the cube control binary, enumerating parts, nodes, and services, then obtaining shells and accessing API and web app source code.

Elevate privileges to access the underlying host in a Kubernetes cluster by deploying a malicious pod with misconfigurations, escaping the container to the host, and compromising the worker node.

this lecture shows moving from a compromised worker node to the Kubernetes master by forcing pod creation on the master, gaining host access, and achieving full cluster compromise.

Show how a default service account with excessive privileges enables cluster-wide compromise by mounting secrets and deploying malicious pods across nodes.

Explore misconfigurations of the Kubernetes API server that expose the insecure port and enable unauthorized access, authentication bypass, and remote code execution, risking full cluster compromise.

Learn how exposing the Kubelik API with anonymous authentication enables remote code execution and information disclosure, risking full cluster compromise on Kubernetes.

Explore how etcd stores Kubernetes control plane data and how secrets created with kubectl can be stored in clear text, illustrating security risks when etcd is misconfigured.

Shows how exposing the Kubernetes dashboard without authentication creates a privileged entry point. Demonstrates using a malicious yaml and a cluster-admin binding to gain full cluster control.

Explore automated tools to spot security issues and misconfigurations in Kubernetes clusters, using scanners that can audit full clusters, YAML files, and container images.

Audit Kubernetes clusters with kube bench against the CIS benchmark using docker. Identify misconfigurations like anonymous API access and insecure port, and review admission control and pod security policy recommendations.

discover how to use Kube Hunter, a free open-source Aqua Security tool, to scan Kubernetes clusters for misconfigurations and exposed Kubelik API, deploying via container and scanning network 192.168.1.0/24.

Run trivy, an open source container scanner from aqua security, to automatically assess docker images for publicly known vulnerabilities in CACP environments.

Explore kube audit, a free open-source Shopify tool, to scan yaml files and audit Kubernetes clusters for security controls, revealing issues like read-only root, privileged containers, and missing caps.

Analyze Kubernetes manifests with Kubesec via Docker for static analysis of yaml files, highlighting privileged flags, missing policies, service accounts, and dropping unnecessary kernel capabilities.

Explore defense techniques and best practices to limit network exposure, understand authorization concepts, manage service accounts, and implement admission controllers, secrets management, and network policies with security context.

Limit network exposure of critical Kubernetes services by enforcing authentication with certificates and mutual TLS, avoiding public internet access for the API server, Kubernetes dashboard, and related components.

Explore role-based and attribute-based access controls in Kubernetes, emphasizing namespace-scoped rules, service accounts, least privilege, and the dangers of excessive privileges and escalation.

Learn to manage secrets for containerized apps by keeping them encrypted at rest and in transit, controlling access to environment variables and tokens, and rotating credentials to minimize risk.

Explore admission controllers as gatekeepers that enforce cluster policies after authentication and authorization, with examples like port security policy and always pull images to maintain hygiene.

Implement network policies to limit the attack surface in a from-scratch Kubernetes cluster by enforcing ingress and egress rules with Calico and blocking outbound connections.

Learn to harden Kubernetes containers with security context, applying non-root user accounts, read-only file systems, and dropped capabilities at the pod level.

Learn to harden Kubernetes clusters by enforcing AppArmor profiles on the host, denying /tmp writes and /password reads, loading and verifying the profile, and applying it to a pod.

Apply seccomp profiles to restrict specific syscalls in containers, using a kernel feature as a firewall to harden Kubernetes workloads.