Operating Kubernetes Securely: Attack Targets, Processes and Meaningful Testing

15. August 2024

Kubernetes is an open source platform for automating the deployment, scaling and management of containerized applications. This has many advantages. In addition to efficient administration, high reliability and stability, Kubernetes also offers very good resource utilization. However, despite its many advantages, the complexity of Kubernetes also brings challenges, particularly in terms of security. In this article, our expert Phillip Ansorge sheds light on the most important attack targets in and around a Kubernetes environment and describes processes and sensible test targets to ensure secure operation.

Phillip Ansorge, Managing Security Consultant, usd AG

Attack targets in Kubernetes

A Kubernetes cluster consists of various components and services that work together to manage and deploy containerized applications. The main targets in a Kubernetes environment are the deployment pipeline, the image registry, the control plane/cluster, the worker nodes and the applications running on the Kubernetes cluster.

Deployment pipeline 

The deployment pipeline is the process by which application code is converted by developers into production-ready container images and ultimately deployed to a Kubernetes cluster. This type of pipeline is an essential part of common CI/CD practice and in most cases is integrated into collaborative version control such as GitLab, GitHub or Bitbucket. Attackers could attempt to exploit vulnerabilities in this process to inject malicious code or compromise the integrity of deployed applications. Attacks on the deployment pipeline can have serious consequences as they can compromise the entire delivery chain of an application.

Image registry 

An image registry is a central repository in which container images are stored and managed. These images contain all the necessary components to run an application, including the operating system, the application and its dependencies. Attackers could attempt to exploit vulnerabilities in the image registry to upload malicious images or manipulate legitimate images. Legitimate images can also contain hardcoded secrets or application code relevant to the attacker. Even read access to the image registry is a risk. Ensuring the integrity and security of the image registry is therefore of utmost importance.

Control plane 

The control plane is the brain of a Kubernetes cluster. It comprises components such as the API server, the scheduler and the controller manager, which are responsible for managing the cluster. Attacks on the control plane can destabilize or completely control the entire cluster. Attackers could attempt to gain unauthorized access to the API server in order to execute administrative commands or manipulate network communication.

Worker nodes 

Worker nodes are the machines on which the containers are executed. They provide the computing power required to run applications in a Kubernetes cluster. Attackers could try to exploit vulnerabilities in the worker nodes in order to gain access or control over other resources. There are two different attack methods. Firstly, an attacker can break out of the container and access a worker node in order to gain access to other containers. The second path leads from the outside to a worker node and control over it. Both paths are aimed at accessing or compromising containers and possibly exfiltrating sensitive data. The security of the worker nodes is crucial to ensure the integrity of the executed applications.

Applications

The applications provided in Kubernetes themselves can also be targets for attack. Vulnerabilities in the application logic, insecure configurations or outdated libraries can be exploited by attackers to gain unauthorized access or disrupt the application. As Kubernetes serves as a platform for deploying and managing applications, it is important that the applications themselves are secure and are regularly checked for vulnerabilities.

Security tests: Processes and objectives

There are many potential testing targets, but where should an organization start first? After all, resources such as time, personnel and budget are limited. Although it makes sense to check the Kubernetes cluster and its worker nodes themselves, it is generally more effective to first focus on the security processes surrounding the deployment pipeline, image registry and application/network security. The cluster or the control plane and the worker nodes are usually not directly accessible to an attacker. The path to the cluster is long and leads via the deployment route, the upstream network or via a breakout from the application.

Testing the deployment pipeline

Deployment pipeline security is critical to ensure that only trusted and verified code enters the production cluster. It is equally important to ensure that an attacker cannot manipulate the dependencies and scripts of the build pipeline.

Testing the image registry

The image registry is a critical element in the application supply chain. A review of the image registry should include the following aspects:

It must be ensured that only authorized users and systems can access the registry and upload or download images.

In addition, images should be checked regularly for known vulnerabilities and malware.

Pentest of the applications

A pentest (penetration test) of the applications provided in Kubernetes is necessary to ensure that the applications themselves are secure and that an attacker cannot succeed in breaking out of the application. If he succeeds, there is not much standing in the way of compromising the worker node and the control plane.

Segmentation test of the network in front of the cluster

Network security is another important aspect that should be reviewed to ensure the secure operation of Kubernetes. Whether a classic segmentation pentest including a firewall check or a configuration analysis of the public cloud environment is necessary always depends on the technology used in the individual case. If namespaces are used for segmentation within the cluster, an in-depth configuration check and/or a pentest for namespace segmentation is also useful here.

Summary

The security of Kubernetes requires a holistic approach that takes all aspects of the environment into account. While securing the cluster should also be considered later on, it is often more effective to focus on the security processes surrounding the deployment pipeline and image registry first.
By implementing robust access controls, regular security scans and comprehensive assessments, organizations can ensure that their Kubernetes environments are resilient to attacks and that the integrity of their applications is maintained. A pentest of the applications and a segmentation test of the network are also essential to ensure the secure operation of the Kubernetes environment.

Also interesting:

DORA Countdown: One Month Left Until the Deadline

DORA Countdown: One Month Left Until the Deadline

DORA, the Digital Operational Resilience Act, will fully apply as of 17 January 2025. We have summarized everything you need to know about the EU regulation, preparation and best practices from our news blog.

Sunset of PCI DSS v4.0 on 31 December 2024: Get Ready!

Sunset of PCI DSS v4.0 on 31 December 2024: Get Ready!

PCI DSS v4.0: In March 2024, version 4.0 of the Payment Card Industry Data Security Standard became mandatory after a two-year transition phase. Just a few months later, version 4.0.1 was released as a minor update of the standard, which will become mandatory on...

Top 3 Vulnerabilities in SSO Pentests

Top 3 Vulnerabilities in SSO Pentests

During their penetration tests (pentests), our security analysts at usd HeroLab repeatedly uncover vulnerabilities that pose significant risks to corporate security. They increasingly encounter the same vulnerabilities. Our blog series "Top 3 Vulnerabilities" presents...

Categories

Categories