Questions tagged [kubernetes]
Kubernetes is an open-source container-orchestration system for automating application deployment, scaling, and management. It was originally designed by Google and is now maintained by the Cloud Native Computing Foundation
53
questions
3
votes
2
answers
421
views
What are the risks of disabling issuer URL validation?
According to the OIDC specification:
The issuer value returned MUST be identical to the Issuer URL that was
used as the prefix to /.well-known/openid-configuration to retrieve
the configuration ...
- 33
1
vote
0
answers
31
views
How to manage temporary AWS credentials for on-premises Kubernetes clusters?
We have several on-premises Kubernetes clusters that need to utilize AWS services. Currently, we use traditional IAM Users with static credentials, but we recognize this is a bad practice. We want to ...
0
votes
1
answer
131
views
How do AWS "Pod Identities" compare to (OIDC) IRSA?
In Kubernetes clusters, we often wish to provide temporary credentials to the containerised processes running in a particular pod, usually marked by associating the pod with a service account.
...
- 165
0
votes
0
answers
35
views
Difference between Spire node attestation with VM instance identities and Kubernetes projected service account tokens
We deploy Spire to self-managed Kubernetes clusters on hyperscaler VMs (i.e. AWS EC2, Azure VMs, GCP Compute Engine)
Technically speaking, we could set up node attestation either based on VM instance ...
- 101
0
votes
0
answers
63
views
K8s Secrets Store CSI Driver
Please note this question is specifically to this CSI driver infrastructure and NOT to the K8s Secrets infrastructure.
Reviewing this implementation with regards to some enterprise work. The ...
- 1,707
2
votes
0
answers
62
views
What can an attacker with root access on a GKE node do on the network?
Let’s say that an attacker, through some chain of exploits, manages to get root on a Kubernetes node. Can they disable network policies on that node? I know that to a large extent this depends on the ...
- 141
1
vote
1
answer
936
views
Can kubernetes pods in the same or different namespace sniff the packets of other pods?
Since the pods share the same subnet, is it possible that one pod can sniff the network packets of other pods? Please explain the reason.
Note: I created 3 pods in the same namespace, on one pod I ran ...
- 53
1
vote
0
answers
148
views
Encryption and storing/managing private key in hosted cluster
I am working on an application running in/on a hosted Kubernetes cluster. All services are built using a Java based stack.
For a new feature it is required to temporarily store notifications (email ...
- 67
2
votes
1
answer
2k
views
Mounting secrets with proper access control in kubernetes pods
I am trying to mount a secret in the pod securely. I have created the secrets with defaultMode: 0400 and runAsUser:1000. However when i am trying to access the secret in the container after doing exec ...
- 53
0
votes
1
answer
100
views
How to store ClientID and ClientSecret in a K8 Env
I am trying integrate our service with SSO. I have generated the ClientID and ClientSecret.
Is it a good security practice to store the ClientID and ClientSecret as a configmap? If not, what are the ...
- 53
2
votes
1
answer
172
views
What're the most common vulnerabilities/weaknesses an attacker would exploit to gain SSH access to a container?
Fair warning - I am a security newbie.
In all container escape/breakout vulnerability scenarios I've read (CVE-2022-0185), the author assumes or states that the attacker already had shell or SSH ...
1
vote
1
answer
178
views
Keeping customer secrets safe from sysadmins and devs in Kubernetes
I've spent a few weeks on GCP and GKE (Kubernetes) trying to figure out how to store customer secrets. The secrets are used by some application even when the user is not logged on so I want to ensure ...
5
votes
2
answers
1k
views
Traditional SIEM in Kubernetes environments
How do companies manage SIEM for Kubernetes environments? I am specifically interested in running CIS benchmarks and auditing OS events on the nodes.
I already have a Wazuh cluster and agents rolled ...
- 151
1
vote
1
answer
141
views
Kubernetes: Should the API port be exposed as a recommended security practice
Judging from what I can see, exposure of the API kubernetes can be especially risky. It seems there are be methods for protecting this, but I am hesitant to consider these as adequate solutions .
I am ...
- 846
1
vote
2
answers
231
views
Kubernetes Cluster Security Model
I am being forced to run my app in a Kubernetes cluster that is shared with another team. The team is not security minded. What is the same cluster security model? Will the other team be able to get ...
- 183
1
vote
1
answer
380
views
Do you encrypt traffic between GKE nodes and external Load balancers?
I have a GKE standard deployment in GCP. I have TLS terminating at an IAAS managed load balancer, provided by their Ingress controller. The certificates are GoogleManagedCertificates. I'm fine with ...
- 113
2
votes
1
answer
450
views
How to secure Kubernetes secrets on bare metal?
(This question is based on a comment I made on How Vault agent solves Secret Zero challenge in Kubernetes?)
We are planning to run some of our software in a Kubernetes cluster running on bare metal (i....
- 121
1
vote
1
answer
830
views
What is the easiest way to find non-vulnerable container images?
I am fairly new to container image vulnerability scanning. There seem to be a lot of tools (Snyk, Trivvy, Clair, e.g.) that can identify vulnerable packages in container images. They also do a good ...
- 123
0
votes
1
answer
458
views
Capabilities DROP in container of Kubernetes pod running with specific UID
I am doing some security research on Kubernetes and I found something still mysterious to me, concerning capabilities.
Example of simple pod:
apiVersion: v1
kind: Pod
metadata:
name: my-pod-httpd
...
- 205
2
votes
2
answers
2k
views
In practice, how should you run privileged or 'root' container?
Running a container as root is a big "no" but are there times we really need to run privileged pods, or sometimes as root?
If so (and feel free to disagree), what are the mitigation controls ...
- 119
1
vote
1
answer
489
views
Why do we use SELinux Policies as it overlaps other controls such as Linux Namespaces, K8S/Container security?
While learning SELinux policies in the Container/Kubernetes environment, I realized that there are other layers of controls that overlap with SELinux.
In these cases, what additional value can I can ...
- 119
3
votes
1
answer
2k
views
What does default Seccomp, AppArmor and SELinux in Kubernetes Security mean?
What does default Seccomp, AppArmor, and SELinux in Kubernetes Security truly mean? Who and where provides the default profile? Does default mean it applies to containers, pods, or the Kubernetes ...
- 119
2
votes
1
answer
299
views
How does Kubernetes Pod Security Standard (PSS) differ from Pod Security Policies (PSP) from design?
Why are we replacing PSP with PSS? What are the motivations and changes in fundamental design?
Both PSS and PSP's objective is to only permit Pods that fulfill a set of secure criteria and conditions ...
- 119
0
votes
1
answer
300
views
Kubernetes user impersonation to obtain exec privileges
I am exploring CVE 2018-1002105 about privilege escalation vulnerabilities in Kubernetes. As a remote unuauthenticated user, I would want to make use of a metrics server deployed on my cluster to exec ...
-1
votes
1
answer
370
views
Modifying cacerts at runtime
I have an containerized JVM application (multiple actually) running on kubernetes, which needs to trust additional custom/private CAs (which are not known beforehand, the application will be deployed ...
- 101
0
votes
1
answer
489
views
Multi Domain SAN or single SSL certificate
I want to use a multi-domain SAN certificate for 5 of my public-facing domains. All of these domains point to the same ingress server (SSL is terminated at the load balancer), but the backend ...
- 11
2
votes
0
answers
391
views
How Vault agent solves Secret Zero challenge in Kubernetes?
HashiCorp Vault Agent creates a sidecar that talks to Vault server and injects secrets as files into containers. The agent presumably uses Kubernetes Service Account in some way. But ultimately there ...
- 185
2
votes
0
answers
222
views
Where should rate limit be applied?
I would like to hear the best recommendations about where to apply rate limit on APIs. We use k8s (microservices) with an ingress controller that is behind an API gateway, that is behind a firewall.
...
- 131
1
vote
1
answer
223
views
How to trust the Kubernetes ingress controller?
In Kubernetes, I use an nginx ingress controller to do TLS termination and load balancing.
When mutual TLS is used, the ingress controller can be configured to forward the client certificate as an ...
- 185
1
vote
2
answers
130
views
Can an API endpoint hosted running on K8S be breached to compromise the entire cluster? Were there ever such attacks?
Can an API endpoint or a Web Application hosted on K8S exposed been breached to compromise the entire K8S cluster? Were there ever such attacks?
i.e., attacker compromises the spring boot based API ...
- 1,073
1
vote
2
answers
239
views
Kubenetes pod passwd
I have a simple Angular application and I deployed it on an Nginx server in a POD on a Kubernetes environment. I realised that I am now able to access the /etc/passwd file on the POD, without even ...
- 113
0
votes
0
answers
61
views
How to protect workload from host [duplicate]
I have some code and other resources which run in a container or VM ("black box") on a host machine. The host uses this as a service to process some files which are highly sensitive and ...
- 109
1
vote
4
answers
250
views
Ingress client certificate authenticate requires CA certificate to be stored in secret?
I want to enable client-certificate authentication in my AKS cluster and I have a basic question which I just don't seem to understand. As per the docs, ingress requires the CA certificate to be ...
- 113
0
votes
1
answer
581
views
Kubernetes show secrets for namespace
I stumbled upon this command:
kubectl get secrets -n namespace-name
(Jay Beale, Attacking and Hardening Kubernetes | KringleCon 2020)
It seems to list the secrets for a specific namespace (here ...
- 282
2
votes
1
answer
254
views
Kubernetes bootstrap token with no expiration
I would like to know the security implications of using a bootstrap token that never expires. The reason why I'm considering doing that is that I'm using terraform and my control-plane is in a ...
- 123
1
vote
2
answers
256
views
Hacking attemps from unkown source
I'm running a docker container in Kubernetes cluster running in aws, I exposed the container through LoadBalancer service and limited access to it just to my ip address using aws security groups, but ...
- 153
2
votes
1
answer
223
views
Container Vulnerability Management
Having difficulty understanding how to translate 'traditional' vulnerability management to a cloud environment. Previously accustomed to using tools like OpenVAS and Nessus, setting up scans which ...
- 123
1
vote
1
answer
203
views
How to implement zero trust concept on a pod running in Kubernetes?
Was thinking to use Ambassador design pattern and filter each request through Nginx with Waf (mod_security or Naxsi) in reverse proxy and ACL, authentication and authorization to pod.
What are the ...
- 997
3
votes
1
answer
2k
views
Is it possible to run commands that exist only on the host on a docker container?
We would like to harden our Docker Image and remove redundant software from it. Our Devs and Ops asked to keep some Linux tools used for debugging on the containers running on our Kubernetes Prod ...
- 145
1
vote
1
answer
109
views
Security loopholes while mapping .kube/config file on to docker as volume
I have a scenario where I have to install Kubernetes on a public cloud and access the Kubernetes via kubectl from a VM on my laptop.
Kubectl accesses .kube/config to connect K8S API-Server to do the ...
- 111
2
votes
1
answer
311
views
Is it a security issue to give the default service account in a namespace an imagePullSecret in Kubernetes?
I'm creating a Kubernetes deployment that needs to pull an image from a private registry.
The private registry requires credentials to authenticate to be able to pull an image, so I've added an ...
- 21
5
votes
1
answer
3k
views
EKS managed worker nodes security patching
Do AWS EKS managed nodes receive security patching automatically or is it the owner's responsibility to patch?
- 53
2
votes
0
answers
417
views
Is it safe to run a Kubernetes container as a root user? [closed]
I run my Spring Boot (Java) application in the Kubernetes environment as a root user and with JMX authentication turned on.
My k8s containers are being flagged as a security risk by the security ...
- 121
1
vote
0
answers
330
views
Cost range of IPS solutions [closed]
We have a client web application running in Azure Kubernetes. There was an optional requirement to implement IPS for the application. It was considered optional, because the application that we are ...
- 1,462
5
votes
1
answer
5k
views
What are the best practices for anti-virus / anti-malware when using containers?
One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for ...
- 153
2
votes
1
answer
8k
views
In AWS EKS, how should Kubernetes certificates be generated?
This article from 2018 states (emphasis mine):
It is common practices for Kubernetes clusters to self-signed their digital certificates. I often get from Security Practictioners the hairy eyeball ...
- 514
0
votes
1
answer
369
views
Cross sign two self signed root CA
I have two self signed root CA that was used for separate kubernetes clusters (say cluster A and B). Both CA is used to sign application certs in their respective cluster.
However, one of the ...
1
vote
1
answer
368
views
URL rewrite spoofable
I am considering using URL rewrites in kubernetes nginx proxy to publish selected context paths in microservices which are run in a cluster running internal services. For example
https://public....
6
votes
2
answers
904
views
What are the security implications of capabilities in Kubernetes pods?
We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities:
...
- 111
0
votes
2
answers
1k
views
What is Cloud KMS? What's it's purpose/benefit of KMS? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)
What is Cloud KMS? What's it's purpose/benefit of KMS? Is there a concrete example of a problem I solve using it? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)
Whenever I've ...
- 111