►
Description
Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Tutorial: Hands-on Hacking Kubernetes and Ways to Prevent It - Eric Smalling, Snyk
Vulnerability exploits too often seem like empty threats that our security teams warn us about but not something that would ever happen to my code! Join me in this hands-on workshop where we will walk through a remote code execution exploit and then talk about the steps you can employ that would mitigate the attack. If you want to participate in the hands-on hacking, a container runtime environment pre-installed on your laptop is encouraged. (i.e. Docker Desktop)
A
Okay,
I
guess
I'll
go
ahead
and
get
started.
Thank
you
for
coming
after
lunch.
Hopefully,
I
keep
you
awake,
I
know:
I
was
I,
got
fully
caffeinated
beforehand,
so
I'm
good
to
go
we're
here
to
talk
about
hardening
against
kubernetes
hacks.
This
is
a
beginner
level
track.
This
is
not
going
to
be
something.
That's
super
crazy!
Look
at
this
crazy
way.
I
found
a
exploits
a
buffer
overrun
or
anything
like
that.
A
This
is
more
of
a
look
at
why
you
need
to
pay
attention,
especially
from
a
developer
point
of
view,
but
also
from
operations.
Why
you
need
to
pay
attention
to
defaults
and
configurations
and
things
that
you
might
not
be
thinking
about
when
you
deploy
an
app
now
I
come
from
a
developer
background,
I'm
not
going
to
read
all
that
I'm
a
developer
Advocate
at
sneak.
A
A
Is
the
GitHub
repository
click
on
the
workshop
directory
in
it?
That
has
the
full
walk
through?
What
we're
going
to
do?
We're
not
going
to
do
a
lot
of
slides
here,
we're
going
to
mostly
be
coming
right
out
of
that
GitHub
repository
one
more
person.
Let's
see
get
my
notes
in
front
of
me
and
we'll
get
going
here
so
today
we're
going
to
be
talking
about
how
the
combination
of
app
vulnerabilities
and
misconfigurations
can
allow
an
attacker
to
spread
the
the
the
radius
of
their
attack
on
your
cluster.
A
This
is
a
pattern
that
most
every
major
exploit
of
recent
years,
pretty
much
follows
an
application.
Vulnerability
gives
an
attacker
the
initial
initial
foothold
and
then
either
application
or
infrastructure
level.
Misconfigurations
allow
the
attacker
to
spread
out
to
other
parts
of
your
system.
It's
pretty
common
narrative
today
we're
going
to
be
talking
about
this
in
the
context
of
kubernetes.
Obviously
we
can
we're
going
to
walk
through
how
we
can
go
from
exploiting
an
app
vulnerability
to
basically
owning
a
cluster.
A
Now
this
is
a
contrived
demo
I'm
not
going
to
show
you
some
fancy
new
rce,
that's
out
there
that
nobody's
seen
before
sorry
to
disappoint
I
have
to
do
something:
that's
easily
reproducible
and
demonstrable.
So
we're
going
to
set
the
stage
here
as
a
hacker
whether
it
be
from
the
outside
in
or
inside
of
a
company.
You
have
found
a
vulnerable
ports.
You
have
found
an
application
that
has
an
rce
and,
throughout
this
and
again
I'll
get
off
these
slides
in
a
second
I.
A
So,
as
I
said,
if
we
go
to
the
first
okay
I'm
on
Wi-Fi,
don't
do
that
we're
going
to
go
to
the
workshop
if
you're,
following
along
we're,
going
to
go
to
First
we're
going
to
stop
here
at
the
beginning,
as
I
said
to
a
couple
people
earlier
that
walked
in
here
anytime,
you
see
a
sneak
person
demonstrating
something
with
a
dash
goof
at
the
end.
Do
not
deploy
this
anywhere
you
care
about.
These
are
usually
highly
highly
vulnerable
repositories.
A
This
one's
not
so
bad,
because
it's
a
contrived
example,
but
we
have
other
ones
out
there.
If
you
go
poke
around
our
account,
if
you
were
to
deploy
some
of
those
apps
to
production,
people
will
own
your
cluster
or
own.
Your
at
least
own
your
environment,
pretty
quickly
they're
meant
for
us
to
demonstrate
vulnerable
things.
So
you
have
been
warned,
don't
put
this
on
your
development
servers,
your
QA
environment,
your
company's
Cloud
account
please.
A
A
A
I
also
supposedly
have
unrate
limited,
Docker
Hub
accounts,
so
we
shouldn't
get
hammered
there
either.
Should
is
the
key
word
so
the
reason
I'm
gonna,
while
people
are
doing
that,
I'm
going
to
talk
a
little
bit
of?
Why
I'm?
Why
we
have
this
platform,
so
Docker
desktop
is
just
easy,
because
it's
there
it's
easy
to
install
a
lot
of
people.
A
Have
it
if,
as
long
as
you
have
Docker
on
your
machine,
if
you're
running
Linux
and
you've
just
got
the
docker
command
line,
that
should
work
just
fine,
the
reason
I
am
using
kind
is
because
it
is
a
nice
reproducible
way
to
demonstrate
a
cubeadm
style
deployment
of
kubernetes.
This
is
meant
to
Dem,
to
be
an
example
of
you
work
at
a
company
and
you're
DIY
in
your
own
cluster
and
some
of
the
things
you
might
or
might
not
be
thinking
about.
A
While
you
do
that
and
as
an
application,
deployer
developer,
deploying
on
top
of
that
kind
of
a
cluster
kind,
is
really
nice
in
that
way,
because
it
is
you
can
put
on
your
own
cni
on
top
of
it,
you
can
do
all
sorts
of
stuff
with
it
you
can
use
other.
You
could
probably
do
this
with
minicube.
You
could
probably
do
this
with
a
lot
of
others,
but
I
chose
kind
because
I
did.
A
One
thing
you
don't
want
to
make
sure
of,
though,
is
if
you
are
running,
Docker
desktop
or
Rancher
desktop,
do
not
be
running
their
kubernetes
make
sure
that
is
turned
off,
because
they
will.
You
will
hey,
you
run
out
of
battery
real
quick,
but
they
will
fight
each
other
and
you'll
may
have
to
know
which
one
you're
pointing
at
not
using
the
docker
one,
because
it
can't
do
multi-node
and
I
can't
do
cni
and
things
like
that.
A
So,
if
you're
running
through
the
setup
at
the
bottom
of
this
setup,
page
you'll
see
that
there
is
a
aptly
named
setup,
sh
file
CD
into
the
setup
folder
run
that
script.
That
is
going
to
stand
up,
that
Cube.
That
kind
cluster
it'll
be
124
for
you
that
the
screenshots
old
it's
going
to
set
it
up
with
two
nodes:
a
control
plane
and
a
worker.
A
It's
going
to
put
I
think
I
have
I,
don't
remember
if
I'm
using
Calico
or
psyllium,
it
says
it's
Calico,
so
it
must
be
Calico
I
changed
it
every
once
in
a
while,
and
it's
going
to
deploy
our
vulnerable
app
into
it
and
set
some
other
things
up
about
it.
You'll
see
at
the
bottom
of
it
a
bunch
of
weightings.
It's
basically
just
caching
up
some
some
containers
that
we'll
be
using
throughout
the
demonstration
at
the
very
bottom.
You
should
see.
A
A
If
you
followed
all
the
steps
and
you're
on
Docker
desktop,
at
least
this
should
work
if
it
doesn't
and
you
get
a
404,
it's
I've
got
some
kind
of
race
condition
in
the
script.
I
need
to
work
on.
If
you
just
rerun,
this
Cube
apply,
which
is
comes
from
the
setup
script.
Just
re
resends,
the
the
Ingress
that
should
that
should
solve
your
404
problem.
Should
you
be
getting
it?
What
you
should
get
is
something
that
looks
like
this
and
as
I
said,
this
is
a
contrived
rce.
A
So
this
is
just
a
python
app
that
allows
you
to
execute
commands
in
a
real
kit.
In
a
real
world
scenario,
a
remote
code
execution
exploit
if
you're
not
familiar
with.
It
is
a
way
that
a
bad
actor
or
attacker,
whatever
can
send
specifically
formatted
requests,
queries
data
into
your
app
and
get
access
to
run
arbitrary
code.
A
On
your
instance,
your
host,
your
server
and
we'll
be
emulating
that
now
we
have
other
demos
out
there
we
can
show
you
of,
like
you
know,
love
Rochelle
or
things
that
allow
you
to
actually
do
that,
but
in
90
minutes
I
can't
really
get
into
all
that
minutia.
So
we
do
this
simple
one
which
acts
like
one
and
gives
a
nice
pretty
demonstratable
face
to
it.
So
for
those
who
are
running
the
setup,
script
can
I
get
a
hands
up
that
you're
still
running
it
or
you.
Okay.
Has
anyone
completed
it?
A
A
Well,
it's
going
to
need
to
be
depending
what
version
of
kubernetes
you're
running
inside
kind.
The
the
setup
it's
going
to
start
is
a
kind
cluster,
with
a
specific
set
of
parameters
on
it
and
a
specific
version
of
kubernetes
124
in
this
case.
So
the
thing
that
takes
the
longest
honestly
is
downloading
that
124
node
image.
A
A
problem
is
most
people
aren't
on
125.
I
shouldn't
say
most
many
people
aren't
on
125..
You
are
going
to
if
you
are
a
consultant
working
with
customers,
whether
you're
a
develop
working
with
developers,
operations
whatever,
if
they're
running
their
own
kubernetes
clusters,
there's
a
very
high
chance,
you're
still
using
PSPs,
so
I'm
showing
them
here
we
will
discuss.
A
A
Why
I'm
using
kind
we
will
talk
about
managed
clusters
like
eks,
sivo
and
whatever
a
little
bit
later
as
well,
but
for
now
I'm
going
to
go
back
to
the
steps
and
when
you
get
to
where
that
sanity
test
is
passed,
we're
going
to
go
start
exploring,
and
this
is
where
you
kind
of
put
on
the
black
hat
ish
and
we're
going
to
go.
Look
at
this,
taking
a
vulnerability
and
going
forward
with
it.
So
we
have
this
vulnerable
route.
A
You
have
an
a
fake
ldap
server
out
there
that
feeds
back
a
class
file
that
can
do
a
remote
shell
back
and
all
of
a
sudden.
You
can
start
running
commands
like
this
on
somebody
else's
host,
so
hostname
is
interesting,
but
the
next
thing
I'm,
probably
going
to
want
to
do,
is
start
poking
around
for
information
about.
What's
going
on,
you
know
in
the
environment,
this
app
is
running
in
so
we're
going
to
run
EnV
and
take
a
look
at
the
environment
variables
all
sorts
of
stuff
in
there.
So
we
get
some
interesting
info
here.
A
A
We
know
that
we're
in
a
kubernetes
cluster,
which
means
we're
probably
running
in
a
container,
obviously,
and
all
that
stuff.
We
see
things
like
a
service
host
one
of
the
more
interesting
pieces
is
we
see
a
kubernetes
port
and
there's
an
internal
IP
address
and
ports.
That
is
the
internal
API
server
endpoint.
That's
the
control
plane
for
kubernetes,
if
you're
not
familiar
with
the
API
server.
A
So
we'll
note
that-
and
this
was
just
you
know-
the
text
in
here
talks
about
that,
and
the
next
thing
we
want
to
do
is
I
want
to
know
what
the
IP
my
my
pods
IP
is
because
I'm
going
to
need
that
info
later
as
well.
So
we're
going
to
send
hostname
space,
Dash,
I
and
I
got
too
many
tabs
already
there
we
go
so
now.
I
have
that
so
I
know:
okay,
well,
I'm
I'm
on
this
10.
address
interesting,
okay,
more
information.
So
at
that
point
let's
take
a
checkpoint.
A
Let's
see
what
we
know
now,
so
we
know
that
we
have
an
application
with
this
rce.
This
remote
code,
execution
vulnerability
and
it's
available
to
us
through
Port
80
in
this
case
we're
pretty
sure
that
we're
running
on
a
kubernetes
cluster,
one
of
the
environmental
variables
in
there
showed
a
port
of
5000.
So
we
probably
earn
a
service
with
this
support.
Is
this
pods?
Listening
on
Port
5000.?
A
We
have
the
internal
API
server,
apparently
of
a
kubernetes
control,
plane
IP
address
sorry,
and
we
know
what
IP
address
we're
running
on
so
pretty
graphic
skip
past.
So
in
the
timeline
of
Doom
we're
in
the
with
that
one
I
had
showed
before
we
know
we
have
an
app
voltm
at
that
point:
okay,
how
many
people
are
still
running
the
setup
script?
A
A
A
So
that
is
a
credential
we
can
use
that
to
try
to
get
at
that
started,
picking
away
at
that
API
server
and
see
if
what
we
can
see
with
it.
This,
which
is
the
next
stage.
This
is
just
a
a
side
saying,
even
if
we
didn't
have
an
rce,
we
could
potentially
get
a
lot
of
this
kind
of
information
through
something
like
the
proc
file
system.
If
we
could
just
get
a
directory
traversal
vulnerability,
we
could
actually
get
into
your
environment
variables.
That
way.
A
A
So
let's
take
what
we've
learned
and
we're
going
to
apply
this
to
try
to
get
out
that
API
server.
So
we
are
going
to
take
the
kubernetes
port.
We
saw
on
the
from
the
environment
of
the
environmental
variables
we're
going
to
I'm
going
to
skip
past
the
the
pecking
away
at
the
at
the
API
server
to
try
to
find
something
vulnerable
and
say
that
I
found
out,
hey
endpoints
seems
to
be
available
to
me
and
we're
going
to
form
a
curl
command.
That
goes
after
that.
A
A
A
This
is
one
of
the
bad
things
about
using
kind,
since
it's
behind
a
Docker
networking
kind
of
layer,
onion
layer,
we're
seeing
an
IP
address
there,
that's
172
1903
in
the
in
this
bottom
section
that
is
very
likely
would
have
otherwise
be
the
public
facing
API
server
endpoint
that
I
could
get
in
at
because
we're
in
kind
we're.
Actually
it's
a
local
host
one.
A
That's
it's
wrapped,
but
if
we
weren't
kind
that
we
could
use
this
IP
now
to
try
to
get
at
this
thing
from
outside
of
this
pod-
and
that's
all
spelled
out
in
the
paragraphs
below
here,
so
we
already
knew
a
bunch
of
stuff
when
the
new
info,
we
have
the
service
account
and
pod
configurations
and
it's
applications.
Namespace
is
using
the
default.
Auto
Mount
service
account
token
setting
of
true.
So
when
you
create
a
service
account
by
default,
that
service
account
token
will
get
automated.
You
can
turn
that
off.
A
You
can
set
that
to
false.
Unfortunately,
the
default
and
kubernetes
is
true,
and
so
it'll
be
there.
You
should
set
it
to
loss
in
my
opinion,
so
we'll
leave
that
at
that
for
a
moment.
So
we
found
that
token
and
we're
able
to
connect
to
the
API
server
with
it
and
again
the
external
IP
is
kind
of
masked.
So
we
now
know
we
have
a
pod
token
inside
the
Pod.
We
have
a
it
allows
access
to
the
endpoints
API.
A
A
So
we
wanted
now
this
this
using
our
rce
this.
This
URL
based
back
and
forth,
is
cumbersome,
so
I
want
to
try
to
use
a
local,
Cube,
CTL
and
that
token,
to
start
accessing
this
from
my
machine.
Now
you
can
imagine
this
could
be
either
a
machine
connecting
over
the
Internet
or
more
likely.
This
is
probably
somebody
who's
got
malware
on
a
laptop
who's
connecting
into
your
QA
cluster
or
your
Dev
cluster.
A
And
we
just
it
just
created
a
quick
config
file
and
set
my
context
to
that.
So,
if
I
do
Cube
CTL,
let's
do
get
pods
I,
gotta
forbidden,
that's
actually
not
a
bad
thing.
Hopefully
I'm
not
riffing
away
from
my
my
steps
here,
but
this
is
telling
me
that
that
tells
me
first
of
all,
my
context
is
set
up
correctly.
A
I
was
able
to
connect
to
that
API
server,
because
I
got
a
forbidden
back,
and
it's
telling
me
that
the
system
service
account
secure
web
admin
cannot
list
resources
pods
in
the
API
Group
in
the
deep
in
the
namespace
default,
because
I
didn't
specify
default
on
the
command
line.
Obviously
so
this
walks
through
all
of
that,
but
that
forbidden
error
exposed
something
interesting.
A
Pure,
if
that's
is
that
legible
from
the
back,
and
you
need
me
to
grow
that
are
we
okay,
so
there's
a
namespace
named
secure,
namespaces
aren't
technically
security
boundaries.
Naming
one
secure
does
not
make
your
deployment
secure,
but
this
one
is
named
secure.
So
that's
where
the
service
account
came
from,
so
let's
try
using
it.
So
we'll
do
add
that
to
my
command
and
sure
enough,
there's
a
pod
single
pod
single
container
in
there
running
a
web
app.
A
A
Let's
see,
let's
see
what
else
we
can
do
with
this,
so
we're
going
to
use
the
cube.
Ctl
auth
can
I
command
and
we're
going
to
list
our
capabilities
so
in
the
default
namespace,
because
I
didn't
provide
one,
it's
saying:
I
can
get
it
endpoints.
So
that
was
my
kind
of
my
first
in
to
know
that
the
token
worked
remember
we
were
able
to
get
endpoints,
that's
interesting,
but
whatever
but
I
don't
really
have
a
lot
of
access
to
access
to
anything
else.
But
if
I
ask
what
I
can
do
in
the
secure
namespace.
A
A
This
is
not
uncommon,
with
with
a
deployment
developer
will
write
a
deployment
and
create
a
service
account
and
create
our
back
for
it
because,
of
course,
I'm
going
to
need
to
access
the
stuff.
In
my
namespace,
it's
my
namespace.
It's
where
my
app
is
deployed.
I
need
access
to
all
the
things
we
they
might
think.
A
So
so
what
we
found
out
now
among
we
already
already
know
all
that
stuff.
The
new
info
is
that
we
have
this
token,
that
has
limited
access
and
default,
but
it
has
broad
access
in
the
secure
named
namespace
and
the
finding
here
is
that
there's
a
role
that
gives
a
service
account
way
too
many
permissions
in
the
same
space
shouldn't.
Have
that
many
verbs
you
shouldn't
give
blanket
access
just
because
it's
your
namespace
doesn't
mean
you
need
to
do
everything
in
your
namespace.
A
So
moving
to
the
next
step,
so
now
we
want
to
get
a
beachhead
in
this
cluster.
We
want
to
get
our
own
code
running
out
there.
It's
been
nice
visiting
this,
this
vulnerable
pod,
but
I'd
like
to
get
my
own
stuff
running
out
there.
So
the
first
thing
I'm
going
to
do
is
I
want
to
get
into
that
pod,
that's
running
with
a
with
an
exec,
so
that
I
have
a
like
a
real
shell
in
there
and
I'm
not
having
to
use
that
web
interface
to
mess
with
it.
A
So
we
have
I'll
rerun
that
pod.
So
there's
our
pod
and
we're
just
going
to
do
an
exec
into
it,
so
I'll
just
type
it
I
have
K
Alias
to
cubesatel,
because
I'm
lazy,
I.T
we're
going
to
go
after
web
admin
up
name
the
namespace
secure
I'm
going
to
go
after
web
admin
and
we
want
to
run
Bash,
okay
and
I'm,
exacting
to
that
pod.
Now,
from
outside
exact
in
who
am
I,
I
can
see
it
from
The
Prompt,
but
I
wanted
to
type
it
to
be
sure,
I'm,
the
web
admin
user.
A
A
You
should
not
run
as
root
if
you
can
avoid
it.
We'll
talk
more
about
that
in
the
mitigation
sections,
but
that's
a
good
sign
for
them.
I
need
to
be
root,
though,
to
do
something
so,
let's
see
if
I
can
sudo
and
become
root,
sudo
not
found
okay.
Well,
this
image
doesn't
have
suda,
that's
that's
good
for
them.
Let's
see
if
we
can
touch
the
file
system
and
make
some
changes
so
I'm
going
to
do
a
touch
test.
A
I
was
able
to
make
a
file,
so
I
have
a
readable
or
I'm.
Sorry
a
writable
root
file
system.
Here,
that
is
because,
whoever
deployed
this
did
not
set.
These
security
context
read
only
root
file
system.
Equal.
True
for
those
of
you
aren't
aware,
when
you
container
runtime
starts
up
a
container.
All
the
layers
that
are
in
the
image
are
immutable.
Basically,
and
then
it
adds
inserts
by
default.
A
read,
write
layer
and
any
mutations
that
happen
at
runtime
are
happen.
A
Happen
there
with
a
copy
on
write
kind
of
an
operation,
so
what
I
just
did
is
told
you
know
the
process
said:
make
a
file,
so
the
file
got
put
into
that
read,
write
layer,
that's
interesting,
we'll
talk
about
why
you
might
not
want
to
run
with
a
read,
write
layer
in
a
bit,
but
we'll
leave
it
at
that
good
information
to
have
so
that's
nice,
but
I
really
can't
do
much
else
here.
I
I,
don't
want
to
really
poke
around
in
here
much
more
but
I
know
now
this
pod
really
isn't
interesting.
A
So
I
want
to
run
my
own
pod.
So
we
have
I'm
going
to
pull
this
up
in
my
IDE
to
show
it
to
you.
We
have
some
demo
yamls
with
different
pods
to
try
to
deploy
I'm
going
to
try
to
run
a
root
pod,
which
is
simply
an
Alpine
pod.
I
just
want
to
see.
Alpine
is
root
by
default.
I
just
want
to
see
if
this
will
run
it's
just
going
to
start
up
and
sleep
I
just
want
to
see
if
I
can
deploy
that.
A
Pod,
it
says
it
created
it
as
you'll
see
right
there.
So
if
I
do
a
git
pod
in
the
secure
namespace,
yes,
I
could
set
my
default
namespace,
but
I
don't
want
to
so
it's
sitting
there
on
container,
creating
it's
probably
pulling
the
Alpine
image
at
the
moment
in
a
moment,
I'm
not
going
to
wait
for
it
right
now,
but
you're
going
to
see
it
change
to
create,
configure,
create
container
config
error,
the
reason
being
if
come
on,
hey
there.
It
goes
so
if
we
do
a
describe
on
this.
A
Pod
root
pod,
see
at
the
bottom
here
it
says,
container
has
run,
is
non-root
and
an
image
will
run
as
root,
so
something
I
didn't
say
that
my
manifest
didn't
have
run
as
non-read
in
it,
but
something
is
doing
that
and
that
something
is
a
pod
security
policy.
I'm
pretty
I
know
because
I
wrote
this
demo,
but
you
can
see
here,
there's
a
PSP
here,
so
pod
security
policy
is
making
sure
no
images
are
running
or
no
containers
are
running
as
roots.
A
That's
also
a
smart
choice,
because
again,
if
even
if
you're
in
a
container,
if
you're
root,
you
have
elevated
privileges
in
that
container,
to
do
things
you
can
do
app
get
install.
Possibly
you
can
do
all
sorts
of
things
you
might
not
want
people
to
do
so.
I've
got
another
pod
here
called
non-root
priv
I'm
going
to
look
at
that
this
one's
a
little
more
longer.
It
has
an
image
called
sneaky.
It's
in
my
Docker
Hub
repository.
It's
my
own
image
of
my
own
crafting.
A
It's
actually
Matt
up
here,
wrote
it,
but
I
took
it
over
and
I
own
it.
Now.
It
is
going
to
try
to
run
with
privileged
mode
on
privileged,
basically
gives
you
access
to
devices
on
the
hosts.
I've
heard
it
called
the
insecure
mode.
So,
but
it's
going
to
run
as
a
non-root
user.
So
it's
going
to
start.
Startup
is
non-root
but
be
privileged,
and
in
doing
so,
I
want
it's
going
to
try
to
mount
the
host
volume
on
the
Node
into
the
container
out
of
at
a
path
called
charoot.
A
A
Oh
actually
read
your
notes.
Are
non-root
peruv
yaml.
This
one
immediately
fails
and
sure
enough.
It
says
pod
security
policy
unable
to
admit
pod
invalid,
privileged
containers
are
not
allowed.
That's
very
standard.
That's
the
standard,
pod
security
example.
You
don't
want
privileged
containers.
Privileged
containers
are
you
you
don't
need
them,
I
mean
unless
you're
writing
like
low
level
monitoring
stuff
for
your
kubernetes
clusters
or
or
you're
running
things
that
you're
a
cluster
you're
a
cluster
op
and
you've
got
things
like
that.
A
A
A
That
says
it
deployed,
so
let's
look
at
and
there
it
is
running,
so
we
have
a
sneaky
pod
that
is
running
so
again.
I
want
to
get
away
from
my
notes,
because
I'll
get
ahead
of
myself,
let's
exec
into
it,
I'm
just
going
to
copy
this,
so
it's
type
it
so
here
I
am
in
my
sneaky
pod.
Now
we
can't
run
as
root,
so
we
are
the
sneaky
user
in
the
sneaky
pod.
A
And,
however,
this
is
my
image.
I
do
have
sudo
in
my
image.
So
now
I
am
root
in
a
pod
in
a
container
on
somebody
else's
kubernetes
server.
What
can
we
do
with
that?
So,
let's
do
a
checkpoint,
real,
quick.
We
now
know
that
the
container
is
somewhat
hardened
by
running
is
non-root
and
not
having
sudo
in
there
the
application
application
container
is
mutable
interesting.
A
A
So,
even
though
you
say
don't
allow
privileged
containers,
don't
allow
root
users,
unless
you
explicitly
say
don't
allow
privilege
escalation,
you
can
and
that's,
because
there
are
applications
out
there
who
need
to
use
possibly
Elevate
privileges
temporarily
to
do
something.
So
the
folks
that
wrote
you
know
the
original.
A
You
know
containerd
Docker
and
podman,
and
all
that
they're
like
oh
we're,
going
to
have
to
allow
that
one
kind
of,
because
there's
too
many
apps
that
would
break
if
we
didn't
nowadays,
I
kind
of
wish
they
hadn't
made
that
decision
and
the
kubernetes
folks
would
have
you
know,
would
change
this
but
again
backwards.
Compatibility.
A
A
For
anybody
that
might
have
caught
up
and
I'm
doubting
Wi-Fi
has
let
you,
but
we
are
now
on
2E,
exploit
MD
part
five,
so
we
have
now
exploited
the
secure
name.
Namespace,
let's
see
if
we
get
out
of
that,
because
I'm
I
want
to
I
I
want
more
I,
always
want
more
I
want
to
expand
my
borders,
so
we
now
have
a
container
with
root
privileges
and
we're
going
to
use
that
to
explore
more
of
the
cluster.
A
We
know
this
cluster
hat
is
hosting
this
vulnerable
application,
we're
saying
in
production,
but
you
know
in
this
environment
whatever
this
might
be,
but
you
know
what
there's
a
good
chance
there
might
be.
People
running
the
same
app
somewhere
else
on
this
cluster
and
I
would
like
to
find
that
if
so,
and
maybe
use
that
to
break
out
so
I'm
going
to
use
nmap.
A
This
is
why
I
needed
root,
because
there
are
some
commands
that
you
need
root
to
run
and
nmap
is
one
of
them:
I'm,
not
a
I'm,
not
an
sys
admin,
I'm,
not
a
network
engineer.
What
I
know
of
nmap
is
it's
a
tool
for
scanning
your
network
to
find
open
ports?
I
know
it
has
valid
uses.
I'm
sure
Mourinho
over
here
can
tell
me
these
cool
uses
that
Network
people
use
nmap
for
but
I
know
it
is.
This
is
the
thing
you
sniff
networks
with
to
break
into
things,
so
what
I'm
going
to
do?
A
First,
so
I'd
like
to
know
what
my
IP
address
is
just
so
I
kind
of
have
a
bearing
of
who
I
am
on
this
on
this
network
and
I'm
using
hostname
I,
you
could
also
use
ifconfig
or
whatever
you
like
and
I'm,
going
to
use
that
in
the
nmap
arguments
which
I
have
to
copy,
because
I
had
to
relearn
these
every
time,
I.
Do
it
and
I'm
going
to
replace?
A
A
A
So
again,
I'm
not
gonna
to
labor
this,
but
we
have
another
app
listening
on
5000,
that's
not
in
the
secure
namespace.
We
know
it's
not
in
the
secure
name
space
because
we
looked
at
the
pods
running
in
Secure
there's
only
one,
and
it
only
has
one
instance,
one
one
replica.
So
it's
got
to
be
somewhere
else.
A
This
also
tells
me
this
plus
the
fact
that
I
was
able
to
hit
Google
pull
images
from
Docker
Hub.
Is
we
probably
have
absolutely
no
network
policy
in
place
here
or
we
have
a
very
loose
one
if
any
and
perimeter
firewalls
are
seem
to
be
not
set
up
either,
which
is
you
know?
Maybe
that's
contrived,
but
Network
policy
missing
is
not
something.
That's
that
that
that
happens
a
lot
a
lot
of
developers
shy
away
from
Network
policy
because
they
think
oh
firewall
rules.
A
That's
not
my
job
Network
policy,
if,
if
you're
a
developer,
Like
Me,
In,
This
Crowd
and
you
look
at
Network
policy
and
you
think
it's
scary-
it's
really
not.
Please
take
some
time
to
learn
it
and
we'll
talk
about
that
in
a
little
bit
as
a
yeah.
We'll
talk
about
that.
A
little
bit
so
I'm
going
to
skip
over
that
we're
just
going
to
go
to
the
timeout.
If
we
now,
we
now
know
that
network
has
nearly
no
or
no
network
controls
are
in
place
here.
A
A
So
we're
going
to
use
that
in
the
sneaky
pod,
we're
going
to
set
up
a
listener
there
on
5001
and
we're
going
to
send
all
traffic
to
this
other
pod
on
5000.
and
I
have
to
adjust
that
IP,
because
it
what
was
it
it
was
130
129,
yeah.
Okay,
there
we
go
so
that's
just
going
to
sit
there
and
Route
traffic
for
me.
A
A
A
So
let's
see
if
it's
vulnerable.
Maybe
this
is
a
new
version.
Maybe
they
know
about
this
vulnerability
and
they
fixed
it.
So,
let's
just
do
command
equal,
oh
I,
don't
know
hostname
again
it's
vulnerable,
so
somebody
else,
maybe
a
developer,
who
knows
is
running
another
copy
of
this
app
somewhere
else
in
the
cluster.
Now,
okay,
so
let's
rinse
and
repeat,
rinse
and
repeat:
let's
try
to
get
the
token
out
of
that
there.
It
is
so
we're
going
to
copy
that
token.
A
Now
again,
I'm
going
to
make
sure
I'm
following
my
steps,
don't
want
to
skip
ahead
of
anything
now.
I,
don't
really
need
the
port
forward
anymore,
because
if
this
is
what
I
think
it
is
I
should
be
able
to
get
into
that
pod.
The
same
way
I
got
into
this
one,
so
just
so
I'm
going
to
kill
my
port
forward
here,
I'm
going
to
kill
my
slow
cat
and
exit
out
of
my
sneaky
pod
I'm,
going
to
edit
that
demo
Cube
config
file,
just
because
it's
easy
and
I'll
just
comment
that
line
out.
A
A
I
dash
dash
lists
so
now
I'm
in
the
default
namespace
with
a
wild
card
resource
that
has
all
the
verbs.
So
why
would
this
have
happened?
Well,
developer,
maybe
deployed
to
default
namespace
in
this
development
cluster
and
didn't
bother
to
go
through
and
set
up
our
back
for
it
just
because
they're
they're
hacking
away
they're
trying
something
out,
not
uncommon.
A
So
yeah,
that's
interesting
to
me.
So
now,
I
would
like
to
try
to
deploy
my
non-rootproof
file
again
into
the
default
namespace.
So
if
you
remember
this
is
the
one
that's
going
to
try
to
run
in
privilege
mode
so
again
we're
kind
of
in
a
rinse
and
repeat
mode
here:
we're
going
to
get
K
apply
file
demo,
yaml
non-root
prove
I'm
not
doing
the
root
one,
because
that's
just
Alpine
and
I'm
kind
of
past
that
I
don't
really
care
right
now.
It
says
it
created
it.
A
A
A
What
am
I
looking
at
okay,
so
I've
become
root.
Now
what
I
can
do
is
kind
of
interesting.
Let's
do
a
PS
there's
my
process
list.
That's
normal
for
a
container
right!
All
I
see
is
the
bash
that
I'm
in
ignore
the
go.
Tty,
that's
another
hack
I
have
in
this.
This
sneaky
image
I
could
actually
be
connecting
through
a
web
terminal.
Go
TTY
server,
go
tdi's
fund,
but
I'm
just
running
PS
here,
I've
just
got
those
are
the
processes
running
in
this
container.
A
However,
if
you
know
I
I'm
again,
I'm,
not
a
CIS
admin,
but
I
know
that
PS
uses
the
proc
file
system
to
list
its
processes.
So
if
I
do
a
true
root
change,
my
route
to
the
aptly
named
charroot
volume
and
do
it
again,
there's
all
the
processes
on
the
host
I'm
now,
basically
rude
on
this
box,
this
node
is
mine
because
I'm
privileged
again
privileged
bad.
A
Unless
you
know
what
you're
doing,
please
don't
use
privilege
and
again
that's
because
the
proc
file
says
the
PS
command
is
looking
at
the
proc
file
system
to
come
up
with
all
the
processes
and
when
I
remapped
to
root
remaps
your
what
what
your
your
root
volume
is
for,
the
you
know,
the
context
of
of
where
you
ran
it.
So
now
we
know
got
a
lot
of
stuff
here,
but
you've
been
following
along,
so
you
get
where
we
are
here.
A
We
we
are
now
finding
that
we
have
no
restrictions
in
the
default
namespace
to
speak
of,
or
at
least
not
enough.
That
stopped
me
from
doing
that.
So
the
next
step
check
my
time.
Well
we're
doing
pretty
good.
Okay,
let's
take
this
over
the
Finish
Line,
as
it
says
so.
Owning
a
node
is
nice,
but
we
want
to
own
a
cluster.
So
now
that
we
have
that
host
file
system,
there's
a
lot
of
information
on
a
node's
file
system
that
is
useful.
A
So
what
we
want
to
get
at
now
is
I
want
to
look
into
the
cube
system.
Namespace
and
I
want
to
see
what
other
nodes
are
in
this
cluster,
so
I
need
a
token
for
doing
that.
Well,
fortunately,
the
kublet
has
one
of
those,
as
you
can
see
in
these
steps.
I'm
going
to
now
use
the
kubelets
cubeconfig
to
start
poking
around.
A
That's
all
that
I
want
to
run
a
pod
directly
on
This
Server
I'm
not
going
to
do
this
because
I
don't
want
to
wait
for
the
Wi-Fi
to
pull
down
BusyBox.
You
can't
the
kublets
token
is
not
allowed
to
ask
the
API
server
to
start
a
pod,
because
it
would
never
need
to
do
that.
Kublet
starts
containers.
Kubelet
talks
to
the
runtime.
It
wouldn't
do
that.
A
So
if
I
were
to
try
to
run
that
I'm
going
to
get
a
forbidden
because
it
doesn't
have
those
privileges,
however
I
do
have
Etsy
kubernetes
manifests,
I
could
put
in
anything,
I
want
in
there
and
it'll
start
those
up
all
day
long
not
going
to
do
that.
That's
that
is
an
option,
though,
but
because
we've
escaped
the
spot
security
policy
and
we
know
what
nodes
we
have
I
want
to
go
after
something
else.
A
I
want
to
launch
I
want
to
launch
a
pod
to
the
node
that
is
hosting
FCD
and
Mount.
The
file
system
there
to
find
out
the
credentials
to
NCD,
because
SCD
is
where
everything
is
so
go
back
to
my
IDE,
see
I
have
a
simple
SCD
pod
definition:
it's
going
to
go,
use
the
standard,
FCD,
3310
image
and
I'm
actually
skipping
forward
here.
A
So
let
me
show
you,
let's
just
let
me
do
this
so
I'm,
going
to
describe
the
Pod
that
we
see
in
there
named
FCD
kind
control,
plane
in
the
cube
system
and
I
can
scroll
up
here
and
there's
all
sorts
of
Juicy
bits
of
information.
Here.
It's
telling
me
where
my
cert
file
is:
what's
my
what's
the
IPS
for
connecting
to
the
to
the
FCD
database,
all
that
good
information
that
I
might
need
to
get
at
go
after
at
CD
now
I've,
because
it's
kind,
it's
all,
going
to
be
the
same
values
every
time.
A
A
If
I
have
time
at
the
end
of
this
I'm
going
to
run
through
showing
you,
the
screenshots
and
I'm,
going
to
try
to
redeploy
this
quickly
on
123
and
show
it
to
you,
but
what
you
would
see
is
this
big
long?
If
you,
if
you
go
on
there,
you
get
it
replace
the
that
command
with
the
right
token
you'd
get
the
output
with
this
token
in
it
set
that
up
the
same
way
we
set
the
other
token
up
and
do
a
can
I.
This
is
old.
A
If
you
then
edit
your
roles,
because
you
have
escalate,
you
can
escalate
your
privileges
to
wildcard
everything
and
do
the
auth
can
I
again
and
now
you
have
wild
card
with
all
verbs
I
apologize
for
that
demo.
Failing
at
the
very
end
there
trust
me,
you
can
do
this
and
I
will
fix
this,
but
what
you?
What
we
did
here
is
we
got
root.
Access
on
the
Node
got
us
the
kublet
token
used
the
kublet
token
to
get
access
to
the
cube
system
resources,
including
NCD
pod.
A
A
So,
like
I
said,
let's
talk
about
ways
to
mitigate
a
lot
of
the
things
we
just
saw
and
if
I
have
time,
I'll
go
back
and
I'll
actually
show
you
that
happening
in
a
second.
So
there's
a
few.
This
is
by
no
in
by
no
means
exhaustive.
There
are
many
things.
If
those
of
you
who
do
security,
you,
you
probably
think
of
a
million
things,
we
could
be
doing
better
in
this
cluster,
but
some
of
the
the
low-hanging
fruit.
A
First
of
all,
we
had
an
RC
and
an
app
now
given
this
was.
This
was
a
contrived
example,
but
you
should
be
scanning
your
apps
for
vulnerabilities
period
now.
Obviously,
I
work
for
sneak
I
would
love
you
to
use
our
tools.
I,
don't
care
what
tools
you
use
honestly
use
whatever
you
sneak
use
whatever
you,
you
have
to
make
sure
you're
catching
any
known
vulnerabilities
in
your
apps.
This
is
just
a
screenshot
of
what
our
tool
would
look
like.
Actually,
we've
updated
our
UI
I
need
to
update
that
static
analysis.
A
Library,
you
know,
dependency
analysis,
image,
analysis,
all
those
kinds
of
scans.
You
want
to
do
all
that
to
find
vulnerabilities,
snuff
them
out
before
they
even
get
committed
to
your
code.
Also,
you
want
to
scan.
You
want
to
have
there's
many
scanners
to
do
this.
You
want
to
go
in
and
look
for
bad
practice
in
your
kubernetes
yaml.
So
here
we're
looking
at
that.
Allow
privilege
escalation
if
you
were
to
run
most
kubernetes
scanners.
This
is
our
the
output
of
ours
it'll,
let
you
know,
hey
medium
level,
severity.
A
Your
containers
running
without
privilege,
escalation
control.
It
walks
you
through
tells
you
why
that's
bad,
how
to
resolve
it.
All
those
kinds
of
things
so
scan
your
code,
scan
your
IAC
files,
scan
everything
you
got
with
whatever
scanners
you
prefer
to
use.
Next,
we
talked
about
this
when
we
saw
it,
the
service
account
token
Auto
Mount.
This
you
should
set
to
false.
A
A
It
just
stops
the
secret
from
being
created
that
you
can
easily
pull
down
from
the
API.
It
does
not
stop
the
token
from
getting
mounted
in
the
Pod
because,
again
backwards
compatibility,
you
may
have
apps
that
do
talk
to
the
API
server
and
they
don't
want
to
by
default,
break
everybody's
app.
That's
not
explicitly
asking
for
that
token.
A
You
should
be
at
least
setting
that
don't
allow
people
to
have
privileged
escalation,
because
they
can,
you
know,
use
suid
now
again
that
can
break
things
so
test.
Your
apps
obviously
lock
down
your
rbac
permissions.
For
goodness
sake,
if
you
were
to
look
into
the
what
we
deployed
in
this
example,
the
web
admin
service
account
are
back
roles,
you'll
see
a
common
mistake.
Giving
your
service
account
blanket
privileges
that
allowed
me
to
get
around
get
start
doing
things
in
there.
A
A
I
don't
care,
but
a
lot
of
people
don't
want
developers
using
default.
It's
just
another
namespace!
However,
it's
everywhere
you
can't
not
have
it.
So
there
are
some
people
who
would
say
block
default
from
getting
deployments
in
your
clusters,
because
then
you
don't
have
to
worry
about
our
permissions
being
set
there
correctly
or
not.
A
That's
your
call.
I
was
talking
to
Duffy
Cooley
about
this.
As
far
as
how
would
you
do?
How
would
you
do
that
foolproofly
and
his
favorite
way
to
do
that?
Actually,
he
said
you
could
just
set
quotas
to
zero
in
default,
so
you
deploy
all
you
want,
but
it's
not
going
to
run
like
it's
interesting,
I,
don't
know!
If
that's
a
it's
it's
it's
it
It's
Curious
way
to
do
it,
but
again
we'll
get
to
more
ways
better
ways.
Maybe
to
do
that
in
a
minute,
be
explicit
in
your
name
spaces.
A
That's
another
way
to
do.
It
is
make
sure
everyone's
deploying
with
a
declared
namespace,
that's
another
again
religious
War.
You
could
have
for
that
kind
of
a
thing.
If
you're
going
to
do
that,
I've
seen
a
lot
of
people
use
customize
so
that
they're
using
that
to
automatically
populate
in
a
namespace
as
they
create
you
know
the
the
or
as
they
do
the
deployments.
A
You
know
the
body
you
look
into
that
if
you
want,
but
the
one
I
want
to
really
talk
about,
though,
is
Network
policies.
I
mentioned
this
earlier
again,
coming
from
a
developer
background,
the
developers
I,
don't
know
why
we
have
this
aversion,
Network
policy
or
network
firewalling,
or
if
you
come
from
the
VMware
space,
the
the
the.
What
are
they,
what
does
NSX
call
it?
They
call
it
the
micro
segmented,
distributed
firewall
right,
it
sounds
so
complicated
and
oh,
my
gosh
tags
and
selectors
and
what
it's
not
you're.
A
Basically,
if
you've,
not
in
I,
don't
know
if
anyone
here
has
not
done
Network
policy,
but
the
basic
Network
policy,
not
even
getting
into
custom
cnis
what
they
provide
on
top
of
it,
but
you're,
basically
just
saying
hey:
this
is
the
Pod
selectors
for
what
can
and
can't
talk
to
each
other
and
I
like
the
standard,
deny
everything
and
then
only
allow
the
pieces.
You
want.
A
A
Technically,
you
probably
need
egress
out
to
DNS,
because
you
can't
do
service
Discovery,
but
that's
you
know,
that's
you'll!
Need
that,
but
other
than
that,
all
you
all
I
would
then
would
add
in
this
case
would
be
I
need
Ingress
to
five
thousand
on
TCP.
That's
all
I
need
I,
don't
want
anyone
connecting
to
any
other
ports.
I,
don't
want
any
egress
out
of
this
app
because
it's
like
a
static
hosting
kind
of
a
thing.
A
If
this
was
a
two-tier
app,
maybe
I'd
have
an
egress
just
to
my
back
end
namespace
or
to
my
backend
pod,
selector
and
then
I
wouldn't
have
any
access,
maybe
between
web
tier.
So
if
I'm
running
five
replicas,
there's
no
reason
unless
I
had
a
distributed
caching
system
and
built
in
for
them
to
talk
to
each
other.
So
don't
allow
that
all
sorts
of
stuff.
A
Now
that's
easy
to
say,
as
the
the
person
up
here
just
giving
a
demo
real
world,
you
probably
have
apms
and
other
things
that
have
you
know,
connections
from
your
apps
coming
back
and
and
things
that
are
specific
to
your
organization
that
you
need
done
blanket
across.
There
are
some
we'll
talk
about
I.
Think
on
the
next
page.
I
have
some
interesting
mitigations
for
that,
but
you
got
to
take
that
into
account.
So
you
got
to
make
sure
you're
not
going
to
break
your.
A
So
that
appears
to
be
duplicated
I'm
going
to
skip
that.
So,
let's
talk
PSP.
So,
as
I
said,
PSP
was
removed
in
v125.
It
was
deprecated
two
years
ago,
and
so
it's
been
coming,
it's
becoming,
they
finally
removed
it
in
125..
Again,
I
showed
it
here,
because
people
don't
upgrade
immediately
to
things
and
PSPs
are
still
going
to
be
out
there.
A
However,
you
should
be
migrating
off
and
you
should,
if
you're
working
with
a
team
that
is
still
using
PSPs,
you
should
be
at
least
planning
to
get
off
of
them,
and
the
six
security
folks,
Tabitha
and
other
folks
have
a
good
blog
about
kind
of
the
history
of
this.
If
you're
curious,
why
did
they
deprecate
it?
What
was
the?
What
was
the
plan
for
the
future
and
then,
of
course,
the
kubernetes
docs
talks
about
what
to
go
to
so
it's
pod
security
admission
is
kind
of
the
new
replacement
for
it.
A
Kind
of
sort
of
it
doesn't
do
everything
PSP
did,
but
it's
kind
of
a
new
take
on
how
to
do
this
kind
of
security.
However,
most
shops
that
I've
seen
or
the
people
that
I've
talked
to
have
are
replacing
it
with
either
kyberno
or
Opa
with
gatekeeper.
An
emission
controller
and
PSA
is
an
emission
controller
on
pod
security
policies.
A
Admission
controllers
for
that
matter,
but
having
policy
management
systems
like
Carbono
or
Opa,
or
whatever
allow
you
to
have
centralized
policy
on
all
of
this
stuff
and
enforce
it
across
your
cluster
and
it's
much
more
flexible
and
you
can
block
all
of
these
kinds
of
things
with
any
of
these
kinds
of
tools.
So
take
a
look
at
those
there's.
There's
I
mean
since
I've
written
this
page,
there's
probably
18
more
blogs.
You
could
add
to
this
because
once
125
went
live,
it's
quite
common
to
need
to
do
that.
A
Network
policy
complexities,
some
things,
some
references
that
you
can
point
your
developers
to
if
they
are
trying
to
learn
Network
policy,
the
kind
of
the
the
Bible,
the
the
recipe
guide,
Ahmed,
all
Balkans,
kubernetes
Network
policy
recipes.
Let
me
go
ahead
and
click
on
that,
because
it
this
is
a
nice
simple
listing
of
ideas
with
most
of
them
having
animated
graphics,
showing
the
policy
we're
talking
about,
looks
like
this
Ingress
egress.
So,
for
instance,
let's
look
at
I'll
pick
one
that
doesn't
have
a
Graphic
process.
A
A
The
psyllium
folks
have
a
really
cool
visualizer.
If
you
go
to
network
policy.io,
you
can
craft
Network
policies
and
it'll.
Show
you
how
it
looks.
Cnis
have
their
specific
policies.
So
if
you
are
a
psyllium
shop
or
a
Calico,
Shopper
insert
the
name
of
your
favorite
cni,
almost
all
of
them,
it's.
What
maybe
well
flannel,
doesn't
have
Network
policy,
so
not
that
one,
but
all
the
rest
have
their
own
network
policy
additions.
Extensions
that
do
things.
For
instance,
Calico
will
have
a
cluster-wide
policy
option
where
you
can
apply
things
not
just
at
the
namespace.
A
Psyllium
has
the
same
kinds
of
things.
So
take
a
look
generally,
your
your
cni
is
going
to
be
picked
for
you.
If
you're
a
developer,
you
don't
normally
get
to
pick
your
cni,
but
you
should
learn
what
your
cni
offers
and
weigh
the
benefits
or
costs
of
using
specific
cni
functionalities,
because
you
are
tying
yourself
to
that
cni
when
you
do
so.
The
network
policy
next-gen
folks
are
doing.
A
A
There's
another
cool
one
here,
I've
never
seen
actually
at
anyone.
I've
talked
to
use,
but
I've
read
blogs
on
this
and
that's
a
link
to
a
Blog,
hierarchical
name
spaces.
Anyone
used
hierarchical
namespaces
here,
no
see
I'm
not
running
to
anyone
using
it.
It
sounds
really
cool,
though
it
allows
you
to
have
hierarchical
namespaces,
which
allows
you
to
set
workloads
in
a
sub
in
a
kind
of
a
sub
tree
pattern
where
you
could
set
Ingress
and
egress
rules
that
apply
to
all
the
namespace
that
are
Downstream
from
it.
A
You've
got
a
parent
Network
policy
propagates
to
its
children,
sounds
really
cool
I'm,
not
Consulting
anymore,
so
I've
not
had
time
to
go.
Try
this
at
any
once,
but
take
a
look
at
the
the
with
that
that
looks
off
to
the
project.
Actually,
it's
not
a
Blog
there
you
go!
So
that's
an
interesting
idea
for
especially
for
handling
that
issue
where
everybody
in
this
company
must
connect
to
our
APM
server.
A
So
you
would
you
could
use
something
like
this
to
implement
that
and
finally
Community
Resources,
obviously
kubernetes
security
I'm
in
there.
Often
this
is
where
a
lot
of
discusses
a
lot
of
the
things
that
you
see
here
came
from
discussions.
There
cncf
tag
security,
which
runs
this
conference.
If
you're
not
attending
tax
security,
it's
not
a
bad
thing
to
lurk
on
at
least
and
get
in
there.
I
try
to
go
to
that.
A
As
often
as
I
can
Sig
Network
for
the
network,
stuff
I
was
just
talking
about
and
then
the
open
ssf
if
you
get
outside
the
cncf
world,
the
open
ssf
talks
a
lot
of
really
cool
stuff,
also
Linux
Foundation
owned,
and
if
that
is
that's
the
end
of
the
workshop
itself
and
I
have
left
us
15
minutes
for
any
questions.
I
can
try
to
get
this.
The
actual
you
know
I
can
bump
down
to
123
real
quick
and
try
to
get
the
the
finish,
the
demo
for
you
but
I'm
thinking.
A
So
the
question
is:
could
we
have
saved
a
step
because
we
had
so
much
access
in
the
secret
secure
named
namespace?
Could
we
have
edited
the
Pod
security
policy
there
to
give
us
privileged
access?
Possibly
that's.
A
good
I
should
try
that
I
should
try.
That
and
I
should
change
my
demo,
then,
to
make
sure
you
don't
have
that
much
access,
but
yes,
that
that
very
likely,
hopefully
you
don't.
That
would
be
one
thing
that
you
would
think
out.
You
would
specifically
not
that's
a
good
one,
though
I,
like
that.
A
A
Overseen
by
working
group,
multi-tenancy
I'm,
not
sure
it's
been
a
while
it's
been
around
a
while,
though
it's
probably
still
an
alpha
whatever
it
is.
I'd
have
to
look
it
up.
I'm
not
going
to
do
that
up
here,
but
yeah
go.
Take
a
look
I'll
find
out
later
today
and
I'll
tweet
it
out
or
something
any
other
ideas
that
we
could
have
blocked
this
early
Beyond.
These.
A
A
Good
question,
so
the
question
is
the
the
run:
is
non-root
stops
the
container
from
starting
as
root
the
escalation
privilege
being
not.
There
allows
you
to
elevate
privilege,
as
you
run,
an
suid
to
become
elevated
privilege
or
basically
root.
What's
the
point
of
doing
one
without
the
other
you
can.
A
The
main
thing
with
the
the
run
is
non-roots
is
in
if,
if
I'm
root
in
a
container,
even
if
I
wasn't
trying
to
do
nmap
and
do
that,
I
can
still
do
other
things
like
I
can,
let's
say:
I've
got
a
standard
Debian
base
image
that
has
the
full
apt
in
it
or
yeah.
I
can
I
can
install
software
if
I've
got
access
to
an
apt,
an
apprepo
because
I'm
root,
because
I
can
do
whatever
I
want
in
a
container
then
and
I'm
uid
0..
A
If
I
found
another
volume
Mount,
maybe
it's
not
a
privileged
one.
Maybe
it's
not
a
root
Mount
like
that,
but
if
I
somebody
has
mounted
another
file
system
in
I'm,
uid
0
in
that
mount.
So
now,
let's
say:
there's
sensitive
information,
application
configurations
that
I
shouldn't
be
able
to
read
as
the
normal
user,
but
I
can
because
I'm
uid
0..
So
there's
that
now
there's
also
username
spaces,
which
is
a
whole
nother
ball
of
wax.
A
A
Other
things
that
I
didn't
talk
about
capability
I
mean
security
context
that
whole
API
for
your
pods
learn
it
understand
what
the
different
things
in
there
do
do
like
capabilities
a
lot
of
time.
You
can
deny
capabilities,
because
your
app
doesn't
need
them.
If
you're
not
doing
low-level
networking
things,
you
don't
need
extra
networking
capabilities
for
your
process.
A
lot
of
business
apps
you
can
just
deny
all
and
they'll
run
just
fine.
You
need
to
test
that.
A
Immutability
is
important.
I
talked
about
read-only
root
file
system.
That's
it's
one
of
my
favorites,
because
it's
an
easy
one
generally,
if
you're
you're,
if
you're,
truly
writing
microservices
they're
going
to
be
immutable
because
it's
one
of
the
12
factors
you're
supposed
to
be
following
12
factors
right.
That
makes
kubernetes
more
easily
able
to
move
things
around.
A
But,
honestly,
that's
things
you
should
probably
be
migrating
away
from
anyway
in
modern
apps,
so
read.
Only
root
file
system
is
one
of
my
favorites,
because
without
it
it
makes
it
harder.
It's
not
a
silver
bullet,
but
it
makes
it
harder.
I
can't
download
a
script
and
start
Bitcoin
mining.
It's
as
easy.
If
I
can't
modify
your
file
system,
I
mean
I
got
the
temp
file
system,
maybe,
but
just
every
little
thing
you
do
makes
it
a
little
harder,
it's
kind
of
like
in
the
old
days
you
have
the
club
on
your
car.
A
Okay,
well
with
that,
I
am
going
to
call
it
done
unless
you
have
anything
else
I'm
going
to.
Let
you
out
early
thanks.
Oh
one
other
thing,
one
thing
I
actually
do
have
a
slide
that
I
do
very
much
care
to
show
if
I
can
get
my
browser
back
up
here
get
past
all.
So
you
have
all
these
slides
that
we're
all
in
the
GitHub
repository.
So
you
don't
need
them.
A
That's
all
we
just
talked
about
I
just
want
to
give
thanks.
First
of
all,
so
the
people
listed
here,
plus
a
ton
more.
A
lot
of
the
content
you
saw
here
is
is
gathered
from
calls
and
and
blogs
and
and
discussions
had
with
folks
like
this
people
in
the
in
six
security
tag.
Security
I
just
want
to
thank
them
all
because
and
we
all
we
all
learn
from
each
other,
and
we
do
have
this
QR
code.