The Call is Coming from Inside the Cluster: Kubernetes Third-Party Tool Risks
Dagan Henderson and Will Kline audit popular Kubernetes add-ons, exposing how third-party storage, logging, and observability tools introduce cluster takeover paths.
Summary
The Expanding Ecosystem of Kubernetes Add-Ons
While Kubernetes core components have undergone intensive security audits, popular third-party operators, CSI drivers, and monitoring agents remain highly vulnerable.
Auditing Third-Party Helm Charts and CRDs
Dagan Henderson and Will Kline evaluate prevalent open-source Kubernetes utilities, revealing excessive RBAC permissions and unauthenticated metrics endpoints.
Exploiting Internal Add-Ons for Cluster Takeover
The speakers demonstrate how compromising a low-privilege add-on container enables escalating privileges to cluster-admin via exposed service account tokens.
Securing the Kubernetes Supply Chain
The authors present auditing toolchains, least-privilege RBAC templates, and admission controller policies to prevent lateral movement across cluster workloads.
Related talks
Red Team Village·57 min
Madhu Akula
Madhu Akula introduces Kubernetes Goat, an intentionally vulnerable cluster environment designed to learn Kubernetes security, RBAC misconfigurations, and container escapes.
Red Team Village·53 min
Kat Fitzgerald
Kat Fitzgerald breaks down Kubernetes architecture, demonstrating practical cluster penetration testing techniques and hardening controls.
Main Stage·44 min
Billy Jheng · Muhammad Ramdhan
Billy Jheng and Muhammad Ramdhan demonstrate multiple novel container escape vectors in Google Kubernetes Engine (GKE) to achieve host node takeover.