How a First Kubernetes Cluster Gets Compromised in One Weekend

▶ Watch (0:52)

Dave, a junior developer at a fintech startup, gets two days to build an internal support tool. He learns Kubernetes from tutorials and an LLM, deploys his app, and shares the IP with his manager. His app runs behind a load balancer on a public cloud cluster. He never thinks about security. By Sunday night, an attacker has already found the cluster. Dave discovers this Monday morning via a finance alert about an exploding cloud bill and a security red alert from his team.

How Attackers Find and Enter Open Clusters

▶ Watch (5:29)

Attackers scan the entire IPv4 and IPv6 range multiple times per day using tools like Shodan and NMAP. Leon confirmed that 33% of all intrusions start with an exposed service as the initial attack vector. Dave’s app was vulnerable to command injection because it never went through QA. Within minutes of finding the open port, the attacker identifies the web app, tests it for injection flaws, and gains shell access to the container without any credentials.

Stealing the Token and Taking the Cluster

▶ Watch (9:00)

Every Kubernetes pod stores a service account token at a known file path. That token acts as the pod’s identity with the API server. Dave bound his service account directly to the cluster admin role, so the stolen token had full cluster privileges. Around 70% of deployments leave this token mounted by default. The attacker copies the token string, opens a second command session, lists all secrets (which are base64-encoded, not encrypted), and deploys a crypto miner hidden under the name “system monitor” as a DaemonSet across every node.

Four Concrete Fixes That Would Have Stopped the Attack

▶ Watch (16:36)

First, disable anonymous authentication on the API server so every caller needs an identity. Second, set automountServiceAccountToken: false on pods that do not need API access. Third, bind service accounts to narrow roles using verbs like list and get only, scoped to a single namespace. Fourth, lock down the container itself: runAsNonRoot: true, readOnlyRootFilesystem: true, and allowPrivilegeEscalation: false. Dropping all Linux capabilities removes privileges most containers never use. Each fix is one or two YAML lines.

Open Source Tools That Enforce These Controls Automatically

▶ Watch (23:24)

Manual YAML review does not scale. The talk recommends four tool categories from the CNCF ecosystem. Vulnerability scanners check images before they leave the developer’s laptop. Admission controllers reject insecure manifests at deploy time, so a pod running as root never starts. Runtime security tools flag anomalies like a shell spawning inside a container and stop the process. Compliance benchmarks give a continuous score so teams know where they stand. Nutanix NKP and Palo Alto Cortex Cloud implement several of these layers out of the box for production clusters.

The Real-World Case: ReactToShell

▶ Watch (25:01)

Dave’s story is not fiction. A vulnerability called ReactToShell hit containerized React applications as a zero-day. Within minutes of public disclosure, internet scanners found exposed instances and began exploiting them. Customers with layered defenses contained the damage. Those without current policies paid the full cost. 89% of companies deploying clusters this year were compromised in at least one attempt. The window between disclosure and active exploitation is now measured in minutes, not days.

Q&A

Is leaving a cluster wide open something only beginners do? Leon said 33% of all intrusions use an exposed service as the initial attack vector, making it the most common entry point across all experience levels. ▶ 07:06

Notable Quotes

33% of all intrusions start with that as the initial attack vector just leaving the door wide open. Leon Schulze · ▶ 07:08

Around 70% of us don’t think about it. We just leave it there. It just exists there. Paul Zerdilas Herrera · ▶ 09:45

in Kubernetes default doesn’t mean that it’s the safest option. And we don’t do that because we are lazy. We do that because we are overwhelmed. Paul Zerdilas Herrera · ▶ 13:41

after it got uh disclosed we saw within minutes that people scan for vulnerabilities and try to exploit it. Leon Schulze · ▶ 25:33

just be aware that default doesn’t mean secure right Leon Schulze · ▶ 27:00

Key Takeaways

  • 33% of all intrusions begin with an exposed service left open to the internet.
  • Setting automountServiceAccountToken: false removes the stolen-token attack path with one line.
  • 89% of companies running Kubernetes clusters were hit at least once this year.

About the Speaker(s)

Paul Zerdilas Herrera is a Cloud Native Architect at Nutanix with a background in mechanical engineering. He specializes in NKP, Nutanix’s Kubernetes platform, and came to security awareness through direct experience deploying and breaking clusters.

Leon Schulze is a Domain Consultant for SecOps at Palo Alto Networks, covering enterprise customers across Germany, Austria, and Switzerland. He focuses on securing cloud-native environments and supporting organizations as they move to containerized architectures.