Kubernetes is a very powerful tool for workload management, but despite having the best intentions, engineers may define insecure configurations (e.g. insecure default configurations, pulling assets from untrusted sources, exposing ports, no resource limits, etc.)
For attackers: this combination of freedom-without-guardrails potentially exposes workloads and clusters to critical misconfigurations. We’ll demonstrate cases when this has gone wrong (i.e. known vulnerabilities), and walk through how to exploit them. If you’re an attacker, this should be a useful pwning k8s 101 talk.
For defenders: We wrote a tool to prevent this. GuardRails does workload policy enforcement and monitoring via K8s admission controller webhooks. During this talk we will open source this tool, and share some common policies from lessons learned of running this in production at Cruise.