Kubernetes Attack Surface and RBAC Complexity

▶ Watch (4:46)

Kubernetes clusters divide into control planes and worker nodes. Control planes run kube-apiserver, etcd, and the scheduler. Worker nodes run kubelet, kube-proxy, and the container runtime. An attacker who controls a container can read source code, environment variables, and environment variables, and attack the kubelet. Controlling a worker node allows lateral movement to the control plane. Compromising the control plane means game over because etcd stores all cluster state unencrypted by default.

The Ingress-Nginx Vulnerability

▶ Watch (15:54)

Wiz researchers discovered a vulnerability in Ingress-Nginx rated CVSS 9.8. An unauthenticated endpoint writes configuration directly into Nginx. By brute-forcing the PID and file descriptor, an attacker loads a reverse shell. Ingress-Nginx runs with a cluster role that can list and watch all secrets, config maps, pods, and nodes. This allows reading any secret theft across any namespace. The exploit chain uses a race condition to guess the temporary file path.

RBAC Atlas: Automated Policy Analysis

▶ Watch (23:11)

Alevski built RBAC Atlas, a CLI tool that detects RBAC misconfigurations without cluster access. It points at Helm charts or YAML manifests and flags toxic combinations like cluster role with list/watch on all secrets. The tool has 110 detection rules. It runs daily on GitHub infrastructure, scanning 25,000 artifacts from Operator Hub and Artifact Hub. The website shows per-project findings, including which service accounts have risky roles and how to exploit them.

Findings and Industry Impact

▶ Watch (26:48)

RBAC Atlas tracks 257 projects across 108 repositories. The top five risks include information disclosure and excessive permissions. The tool classifies risks as critical (star on any API group resource verb), high, or medium. Alevski found that many open-source projects ship with overly permissive RBAC policies. The website provides a cloud-native threat landscape for the most popular Kubernetes projects. All code is open source.

Q&A

Is Nginx Ingress now abandoned? Yes, and that means vulnerabilities go unpatched. ▶ 30:01

Does Google use open source Kubernetes internally? I cannot speak for my employer, but Kubernetes maintainers include engineers from many companies including Google. ▶ 30:45

Can you point RBAC Atlas at first-party Kubernetes configs? Yes, it works offline against Helm charts and YAML, and you can create custom detection rules. ▶ 31:45

Have you seen similar systems for other policy languages? The engine could be translated to other YAML definitions with AI, and companies are already doing similar abstraction for query syntaxes. ▶ 32:51

Notable Quotes

RBAC misconfiguration is among the, you know, like one of the top causes and the reason is because it’s very powerful, but also it’s very very complex, right? Lenin Alevski · ▶ 22:17

This is considered the canonical way to compromise Kubernetes clusters in the in the Kubernetes community. Lenin Alevski · ▶ 12:10

If someone made a mistake of assigning this role to a service account that is associated to an application that that application gets pawned because it’s exposed to the internet, that’s the same of giving the attacker complete control of the cluster, right? Lenin Alevski · ▶ 13:54

I just scanned over 25,000 artifacts, so I have data from the last 6 months. Lenin Alevski · ▶ 26:03

The idea with that is like I have now like a cloud native threat landscape of the whole at least the most popular projects in the in the industry. Lenin Alevski · ▶ 26:25

Key Takeaways

  • RBAC misconfigurations are a top cause of Kubernetes breaches due to complexity.
  • The Ingress-Nginx vulnerability (CVSS 9.8) allows reading all cluster secrets.
  • RBAC Atlas scans offline and detects risky permissions across 257 projects.
  • The tool is open source and runs daily on GitHub and runs daily on GitHub infrastructure.

About the Speaker

Lenin Alevski is a Full Stack Engineer and generalist with a lot of passion for Information Security. Currently working as a Security Engineer at Google. Before joining Google, Lenin worked at MinIO, OneLogin, Oracle and Websec Mexico as an appsec engineer, software engineer, security…