Securing and Pentesting the Kubernetes Monster: Hardening Cloud Native Clusters
Kat Fitzgerald breaks down Kubernetes architecture, demonstrating practical cluster penetration testing techniques and hardening controls.
Summary
Demystifying the Kubernetes Architecture
While Kubernetes can appear overwhelming with its myriad interconnected components (etcd, kube-apiserver, kubelet, kube-proxy), its security fundamentals follow clear principles.
Attacking Insecure Cluster Configurations
Kat Fitzgerald walks through common Kubernetes attack vectors—including anonymous API access, default service account token abuse, and unauthenticated etcd access.
Demonstrating Container Escapes to Host Nodes
The speaker illustrates exploiting privileged containers and host volume mounts to break out of pod isolation and seize underlying node controls.
Essential Kubernetes Hardening Strategies
The presentation provides DevOps and security teams with practical checklists—enforcing strict RBAC policies, NetworkPolicies, pod security standards, and TLS encryption.
Related talks
Main Stage·38 min
Dagan Henderson · Will Kline
Dagan Henderson and Will Kline audit popular Kubernetes add-ons, exposing how third-party storage, logging, and observability tools introduce cluster takeover paths.
Cloud Village·2 hr 30 min
Magno Logan
Magno Logan delivers a comprehensive workshop on securing Kubernetes clusters, covering API servers, etcd, RBAC, admission controllers, and network policies.
Red Team Village·57 min
Madhu Akula
Madhu Akula introduces Kubernetes Goat, an intentionally vulnerable cluster environment designed to learn Kubernetes security, RBAC misconfigurations, and container escapes.