Tomasz Cholewa - Hack your Kubernetes cluster and secure it properly

Kubernetes Exposure Context

Tomasz Cholewa frames the talk from a worried Kubernetes user’s perspective, noting AI workloads increasingly run on clusters where security often lags adoption. He revisits a recent Wiz finding in the widely used Ingress NGINX controller that alarmed organizations after his earlier presentation.

Ingress NGINX Exploit Chain

Ingress NGINX exposes an unauthenticated admission webhook endpoint reachable from pods. Attackers craft malicious admission reviews using dangerous annotations, upload oversized files to create temporary filesystem artifacts, then probe file descriptors to recover deleted content and load a malicious shared library into the controller container.

Privilege Impact and Mitigation

Because Ingress NGINX’s RBAC can read secrets cluster-wide, demonstrated exploits retrieve secrets from all namespaces—He cites that over 40% of organizations use this controller for its maturity and annotation extensibility. Cholewa urges upgrading patched controller versions and reviewing assumptions behind the attack prerequisites.