►
From YouTube: Hacking into Kubernetes Security for Beginners - Ellen Körbes, Tilt & Tabitha Sable, Datadog
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Hacking into Kubernetes Security for Beginners - Ellen Körbes, Tilt & Tabitha Sable, Datadog
While Kubernetes can be challenging to newcomers, Kubernetes security overwhelms even the most seasoned professionals. It's a big challenge, so where should you even start? In this talk, Ellen and Tabitha will present an overview of concerns in Kubernetes security. And not only that: they’ll exploit issues along the way! Topics covered will include RBAC, admission control, and vulnerabilities in Kubernetes, Linux, your code, and underlying dependencies. You'll learn a mental framework, see its real-world impact, and leave with the knowledge you need to be able to “look it up, baby."
A
A
A
No,
I
can't
okay,
so
maybe
there's
some
security
in
place
here
and
I
can't
see
what
everyone
else
is
doing.
Okay,
you
know
what
I'm
not
calling
the
security
people.
They
are
not
fun
I'll
I'll.
Do
this
on
my
own.
Let
me
check
something
out
here.
I
remember
seeing
something
funny
in
the
onboarding
documents,
so
I
was
looking
around
the
docs
and
I
found
this
dav
database
controller.
So
the
controller
creates
new
database
instances
pre-populated
with
fake
data
for
use
in
dev
environments.
A
It
hangs
often
you
can
exact
into
the
pod
and
if
it's
really
wedged,
you
can
restart
the
process
by
deleting
and
recreating
the
pod,
and
someone
said
something
here
about
fixing
our
back
privileges.
Okay,
so
we're
using
our
back
and
our
back.
Is
that
thing
where
I
have
some
permissions?
There's
some
things
I
can
do
in
the
cluster
and
there
are
some
things
I
can't.
A
So
let's
try
that
so
we're
looking
at
a
dev
database
controller.
Let's,
let's
see
if
we
can
find
that
what
can
I
do?
Normally,
let's
see
keep
cuddle
off.
Can
I
so
I
can
do
whatever
I
want
in
my
own
namespace,
but
when
I
try
to
look
at
someone
else's.
So
let's
see,
let's
see
what
catherine's
doing
here
when
I
try
to
look
at
someone
else's
namespace.
A
The
stuff
that
I
can
do
is
very
little
almost
nothing,
let's
check
something
out.
So
let's
look
at
what's
going
on
again
and
I
have
this
dev
environment
controller.
I
should
be
able
to
create
pods
in
it.
Yeah
the
documentation
was
right
so
for
pods
I
get
a
star
which
means
I
can
do
whatever
I
want
with
pods
and
I
can
exact
into
pods
as
well.
So,
let's,
let's
try
and
make
use
of
that
and
see
what
happens?
Let's
see,
let
me
do
cube
cuddle
get
pods
and
here's
one.
A
Yes,
I
do
thank
you
when
you
leave
tooling
around
attackers
become
very
happy
and
speaking
of
attackers.
So
what
can
I
do?
Let's
see
what
I
can
do
from
within
this
controller?
Let's
say
again:
what
can
I
do?
Would
you
look
at
that
stars?
Stars
more
stars,
like
a
great
philosopher
once
said
we're
made
of
stars,
but
our
back
shouldn't
be
and
oh
boy,
they
were
right,
so
I
can
do
whatever
I
want
here,
which
means
I
can
probably
see
what
my
friends
are
doing
yeah.
A
A
Oh
joey,
I
told
you
to
stay
out
of
my
turf,
joey
yeah
you're,
getting
grounded,
that's
enough.
Joy,
so
keep
cuddle
edit
on
joey's,
and
here
we're
going
to
replace
joey
using
my
part
with
joey
using
420,
because
I
know
the
kind
of
stuff
joey
likes
to
do
so
get
out
of
here.
Joey
there
you
go
and
now
I
can
probably
get
out
of
here
and
run
my
stuff.
Finally,
and
there
you
go
now
everything
works,
and
now
I
tilt
up
and
my
application's
working.
B
Hello,
this
is
tabitha
devsecops
enforcer,
joey,
joey,
joey,
calm
down,
calm
down,
I'm
I'm
gonna
help
you,
but
you
gotta
explain
it
to
me.
You
gotta
tell
me
calmly,
what's
going
on
okay,
so
you
you
can't
get
into
your
dev
environment.
Well,
let
me
let
me
have
a
look
okay.
So
I'm
going
to
look
at
your
service
first
because
that's
always
been
a
problem.
B
B
Devon
controller
looks
okay,
joey,
I'm
I'm
gonna
put
you
on
hold
for
a
moment.
While
I
do
some
more
investigation
of
this
I'll
be
right
back.
If
this
was
changed
and
and
joyce
says
he
didn't
change
it,
I'm
gonna
have
to
go
and
look
in
our
log
management
system
to
see
if
the
api
server
audit
logs
can
tell
me
what's
going
on
okay,
so
I
have
to
first
look
for
our
kubernetes
audit
logs
and
let's
do
in
the
namespace
joseph
pardella.
B
Okay,
there's
a
lot
of
logs
here.
So
let's,
let's
look
at
what
has
been
done
inside
his
namespace,
okay
patch.
That's
that's
going
to
be
the
ones
where
things
were
edited.
Let's
have
a
look
at.
Let's
have
a
look
at
these
here's
one
that
says
devon
controller
recently
modified
joey's
ingress.
Okay,
that's
that's
interesting!
Why
would
the
dev
end
controller
have
done
that
inappropriately?
B
B
In
the
devenv
controller,
recently,
okay,
so
it
looks
like
for
dev
maintenance
ellen
was
allowed
to
execute
a
show
in
the
devnf
controller
and
then
right,
afterward,
the
devent
controller
service
account
modified
joey's
modified
joey's
service.
Yeah,
that's
that's
suspicious
girl.
I
think
you
just
got
yourself
in
trouble.
Okay,.
B
A
A
A
B
A
B
B
Yeah
no
node
ports.
So,
like
d,
do
you
have
any
idea
where
I
may
have
gotten
these
logs
that
show
you
modifying
joey,
pardella's
dev
environment,
to
point
at
port
3420?
Do?
Do
you
think
you'd
like
to
take
a
moment
to
explain
yourself?
You
got
to
get
your
act
together.
Ellen
you've
got
to
cut
out
this
childish
movie
hacker
like
garbage,
behavior
you're
supposed
to
be
a
professional,
and
this
ain't
it
you
gotta,
get
it.
A
A
A
I
would
get
the
rest
of
the
day
off.
Are
we
vulnerable
to
this
cube
cuddle
version?
We
are
16.1
and
what
we
have
here
is
16.2
yeah.
You
should
be
vulnerable,
where's,
the
poc
all
right.
This
is
cool,
apparently
we're
dealing
with
kubernetes
vulnerability
here
and
they
don't
come
around
very
often,
but
when
they
do,
they
can
ruin
your
day.
A
B
B
Thank
you
so
much
for
that
great
demo.
Miss
libby,
having
a
principal
engineer
like
you
on
the
staff,
is
a
huge
inspiration
to
the
entire
rest
of
the
engineering
division.
Now,
for
the
last
part
of
our
monthly
all
hands,
I'm
going
to
give
an
update
about
security
initiatives.
Let's
see
how
do
I
share
my
can,
can
can
can
everybody
see
my
screen?
Unfortunately,
so
all
right
today,
I
need
to
talk
to
you
because
of
some
activities
of
a
questionable
nature
that
have
been
happening
in
our
environment.
B
So
admission
control
is
what
you
need
to
be
able
to
enforce
policy
about
what
settings
are
allowed
to
be
put
on
a
pod,
such
as
privileged
or
host
name
spaces.
So
we're
going
to
be
deploying
new
admission
control
policies
that
are
in
line
with
the
kubernetes
project,
pod
security
standards
document,
the.
B
B
Thank
you
ellen.
No,
the
pod
security
standards
document
describes
best
practices
for
running
pods
in
kubernetes.
I
think
you're
thinking
of
pod
security
policy,
which
is
a
feature
that
was
deprecated
in
1.21
but
will
be
replaced
soon
with
a
new
admission
controller
and
that's
irrelevant
to
us
anyway,
because
we're
going
to
be
using
gatekeeper.
But
thank
you
for
your
concern.
B
So
getting
back
to
the
presentation,
the
importance
of
admission
control
is
because
our
back
works
at
the
level
of
kubernetes
objects.
Like
can
you
read
or
write
this
pod
or
service,
but
it
doesn't
have
any
opinion
at
all
about
whether
a
pod
is
a
harmless
web
server
or
a
privileged
command
shell
that
exposes
all
of
the
node's
data
so
to
enable
that
kind
of
control
we
need
to
have
admission
controller
and
admission.
Control
then
gives
the
api
server
opinions
about
what
should
be
allowed
and
what
shouldn't
shouldn't
you
be
doing
that?
B
B
B
I
wish
you'd
stop
talking
to
all
of
us
ellen.
As
I
was
saying,
our
service
discovery
system
will
be
integrated
with
the
network
policy
engine.
So
most
of
the
work
of
writing
policies
will
be
taken
care
of
for
you
and
after
you've
added
the
last
few
touches.
Then
kubernetes
will
enforce
what
can
talk
to
what
within
the
cluster
in
order
to
reduce
attack
surface.
B
Now
that
we're
web
2.0
scale,
our
developers
have
been
struggling
to
keep
up
with
the
over
12
containers
that
are
deployed
in
production,
so
with
this
scanning,
the
the
scanner
will
run
every
time.
A
new
container
is
built
by
ci
and
it
will
send
an
email
to
the
developer
about
any
findings
there,
we're
not
going
to
be
blocking
deploys
right
now
because
of
these
results.
This
is
only
for
your
information,
but
if
we
find
that
these
results
are
getting
worse
over
time,
there
may
need
to
be
further
follow-up.
B
So
thank
you
all.
I
want
to
leave
with
one
last
bit
of
information
or
perhaps
a
warning
for
some
of
you.
We
will
now
carefully
audit
all
logs,
especially
the
kubernetes
api
server
audit
logs,
in
order
to
detect
any
malicious,
behavior
or
shenanigans
that
might
be
occurring.
So,
thank
you
all
so
much
for
your
time
this
afternoon.
A
You
are,
I
don't
like
working
in
a
panopticon,
and
this
is
way
too
much
of
a
dystopia,
no
one's
auditing,
anything
I'm
gonna
get
in
there
and
see
what
they're
trying
to
do
and
if
they're
trying
to
make
me
uncomfortable
I'll,
just
take
some
drastic
measures
now
to
do
that,
I'm
gonna
need
root
access
to
the
development
environment
server
and
they
talked
about
admission
control,
but
they
didn't
mention
that
it
was
deployed
yet
and
if
it's
not
deployed
it's
not
so
hard
to
run
a
pod.
That
gives
me
a
root
shell.
A
So
I'm
gonna
try
my
favorite
incantation
here
and,
let's
see
if
it
works,
let's
go
back
to
duffy.
This
is
such
a
classic,
and
I
love
this
forever.
Is
this
gonna
work?
No,
it
doesn't
okay.
What
else
can
I
do?
What,
if
I
can
mount
a
host
path
so
that
I
can
access
stuff?
That's
on
the
node
from
a
pod?
Would
that
work?
Let's
see,
I
have
this
script
here:
let's
try
and
run
it
and
see
if
it
gets
true,
so
I'm
going
to
apply.
A
A
A
A
Okay,
we're
all
set.
This
is
going
to
be
a
two-stage
tag.
First,
I
need
to
set
up
a
reverse
shell,
so
that
when
my
exploit
calls
home,
I
can
pick
up
the
call
and
second,
this
is
what
I
need
to
run.
What
this
is
going
to
do
is
I'm
going
to
interact
with
the
host
network
directly
and
because
of
this
container
d
vulnerability,
I
don't
have
to
talk
to
kubernetes.
I
can
tell
container
d
itself
to
run
whatever
container
I
want.
A
So
this
means
I
can
run
that
hostpath
container,
that
kubernetes
wouldn't
like
me,
because
even
if
kubernetes
security
is
set
up
100
correctly,
if
I
can
exploit
a
vulnerability
in
something
that
kubernetes
is
running
on
top
of,
I
can
bypass
all
of
kubernetes
completely,
and
then
it
doesn't
matter
I'm
in
so,
let's
see
if
this
works
and
it's
running
is
this
working.
Yes,
it
found
home
now
final
stage.
A
A
A
What
is
this?
This
is
unfamiliar
and
I
don't
like
unfamiliar
things.
What
is
this
part?
It's
running
on
cube's
system.
I
don't
remember
seeing
this
on
cube
system
before,
let's
check
out,
let's
look
at
the
container
and
oh
boy
this
this.
I
don't
know
what
this
is,
but
it
looks
highly
unusual
and
what
this
is
running
is
wait,
nat
cat!
No,
no!
No!
No!
I'm
the
one
running
that
cat,
I'm
the
hacker
here.
Why
would
anyone
else
be
running
that
cat
unless
fascinating
a
hacker?