AI
Lab Architecture: Hosted Cluster, Four eBPF Tools, One Adversary Emulator
The workshop ran fully hosted so attendees needed only a GitHub account and a browser. Four tools were pre-installed: KubeScape node-agent, Pixie, Tetragon, and Inspector Gadget. The adversary emulation tool was Rán, named after the Norse goddess of sea calamities. Its techniques map to the MITRE ATT&CK framework, and it intentionally limits what the attacker knows about the environment, because a real attacker would not know your cluster layout either.
Initial Access and Shell Detection with Tetragon Tracing Policies
Rán gained initial access by simulating a leaked kubeconfig that was baked into an OCI image and found on GitHub. The first defensive step was a Tetragon tracing policy, a CRD that hooks a kprobe on the sys_write syscall for specific shell binaries. Running id through kubectl exec produced a JSON event naming the shell binary, its architecture (x86), and the parent process arguments, revealing exactly how Rán implemented the command as sh -c id. No C code was written.
Service Account Token Theft and Anomaly Detection with KubeScape
In room two, Rán read the service account token from its canonical path and installed kubectl via curl into /tmp. KubeScape node-agent flagged three anomalies: unexpected service account token access, an unexpected process (kubectl is not part of an nginx image), and an outbound network connection from a container shell to the Kubernetes API. A fourth alert, drift detection, fired because kubectl was executed from the upper layer of the container filesystem, meaning it was dropped after the container started, not shipped in the original image.
Network Discovery: Nmap vs. Reverse DNS Scan
With the service account token proving low-value, Rán installed nmap and ran a full TCP scan of the pod subnet. Pixie detected the scan by showing all TCP connections from the dungeon namespace entry-hall pod to other workloads. Rán then ran a reverse DNS scan using gethostbyaddr against each IP in the range. Pods behind a NetworkPolicy were invisible to nmap but Argo CD pods still resolved through kube-dns, because DNS queries never touch the target machine. KubeScape flagged the DNS queries as anomalies since that workload had never performed DNS lookups before.
Redis CVE Exploit and eBPF TLS Interception
The observability namespace contained a Redis pod running a 2022 CVE-affected version, pulled in by an LLM that defaulted to an old stack. Rán installed redis-cli and exploited the instance. The intended detection was Pixie querying the Redis protocol table. Pixie hooks TLS library symbols in-process so it captures traffic after decryption, before encryption, without actually decrypting anything. Protocol inference then lets it decode Redis, Kafka, and Cassandra queries in plain text. Injected payloads, including fileless exploits sent over the wire, become visible as query strings.
Kubelet Node Proxy Abuse and the Custom eBPF Gadget
The Redis pod carried an observability service account with nodes/proxy get permission. Any service account with that permission can send HTTP GET requests to the kubelet, which maps the verb to the exec endpoint and executes commands on any container on that node. Rán used a fileless binary (runws), loaded via a file descriptor under /proc/<pid>/fd/3 and never written to disk, to run commands on the Argo CD application controller. A custom Inspector Gadget eBPF program attached to kubelet binary offsets where TLS traffic is decrypted, capturing the GET request to /exec, the full bearer token used, and the websocket upgrade, giving defenders the exact compromised service account to trace back through the attack chain.
Notable Quotes
so this is an ebpf workshop without writing any C code. Right? So the first abstraction we’re using here is a CRD called tracing policy. Constanze Roedig · ▶ 19:02
any service account that has nodes/proxy get permission can execute commands on any bot actually container if I’m precise in your cluster that’s a fact Teodor Janez Podobnik · ▶ 01:09:09
this was brought up by Graham in January And there was literally no solution for it neither like how to detect it etc. So what we did was we came up with a gadget actually an EVPF program that is able to detect the this attack actually we identified the unique signature it has and are able to alert based on it. Teodor Janez Podobnik · ▶ 01:09:49
if you let Claude or whoever is your um pull in defaults you don’t check it there might be really outdated versions and of course if you then have end mapap with the version scan n mapap also has lua plugins that can actually recognize well this version isn’t just that version but it’s also vulnerable and can even do an exploit Constanze Roedig · ▶ 01:01:35
Key Takeaways
- Tetragon tracing policies hook kprobes on shell syscalls without writing C code.
- KubeScape drift detection catches binaries executed from a container’s upper filesystem layer.
- Reverse DNS scans bypass NetworkPolicy by querying kube-dns instead of touching target pods.
- A single
nodes/proxyget permission grants remote code execution on every container in the cluster. - eBPF can attach to kubelet TLS offsets to capture decrypted exec traffic and identify compromised tokens.
About the Speaker(s)
Constanze Roedig is an astrophysicist turned entrepreneur with over 15 years building complex systems for finance and government. She is a CNCF Ambassador, CS lecturer, and key researcher at SBA-Research and fusioncore.ai. She created the K8s Stormcenter, an open Kubernetes sovereign SOC.
Markus Gierlinger brings over 12 years across software engineering, security research, and product management at Manifold Security. His prior work focused on Kubernetes security.
Teodor Janez Podobnik is a Platform Engineer turned Tech Lead at Prewave GmbH with 7 years designing complex systems. He is an eBPF researcher, a judge for the eBPF Summit Hackathon 2025, and host of the eBPFChirp Podcast.