Kubernetes attack & defense

Correct — A shared language for the attacker’s playbook against clusters.

Correct — It is the front door; exposure or weak auth is critical.

Correct — anonymous-auth must be off; an open kubelet is a direct foothold.

Correct — Read access to etcd is read access to every secret.

Correct — Reaching 169.254.169.254 can yield cloud IAM credentials.

Correct — The Tesla cryptojacking incident exploited exactly this.

Correct — You trace pivots: pod → SA token → API → other namespaces → node → cloud.

Correct — Node compromise exposes all co-located workloads’ identities.

Correct — A namespace alone is not a strong security boundary.

Correct — Harvesting identities to move laterally.

Correct — Close the front doors before hardening the interior.

Correct — A structured way to measure and improve detection.

Correct — Role/ClusterRole + RoleBinding/ClusterRoleBinding define who-can-do-what.

Correct — It bypasses the normal privilege-escalation prevention.

Correct — Even without escalate, bind can attach cluster-admin.

Correct — Pod creation is a well-known escalation primitive.

Correct — A direct escalation if you can impersonate a privileged identity.

Correct — A powerful, often-overlooked permission.

Correct — Secrets are base64, readable by anyone with get/list.

Correct — Scope SAs tightly; a leaked token is API access.

Correct — Remove the credential where it is not needed.

Correct — A leaked bound token expires and is narrower in scope.

Correct — These verbs/resources are the escalation surface to review.

Correct — Grant only the verbs/resources a subject truly needs.

Correct — Admission is the last gate before etcd.

Correct — Mutation → schema validation → validation is the order.

Correct — e.g. reject privileged pods or unsigned images.

Correct — A built-in admission plugin with enforce/audit/warn modes.

Correct — The hardened baseline that blocks most escape enablers.

Correct — An attacker who can disrupt the webhook evades the policy.

Correct — Secure-by-default, but you must keep the webhook highly available.

Correct — Overbroad exclusions are a common admission-policy weakness.

Correct — Policy-as-code as an admission gate.

Correct — It sees and gates all matching API writes — protect it like the control plane.

Correct — Mirrors every policy rollout in the course.

Correct — PSA covers pod security context; the engine covers the rest.

Correct — Enable an EncryptionConfiguration (ideally KMS-backed).

Correct — Restrict etcd to the API server and protect its backups.

Correct — Otherwise the kubelet API can be hit unauthenticated.

Correct — Lock the front door and record everything.

Correct — A malicious/vulnerable operator can act across the cluster.

Correct — Its ClusterRole often requests broad permissions; scrutinize them.

Correct — Crafting a malicious CR can drive the controller to do harm.

Correct — Tighten what a compromised operator could touch.

Correct — The primary source for detection and forensics.

Correct — CA compromise lets an attacker forge any client cert.

Correct — Shared responsibility: they run the API server/etcd; you secure what you deploy.

Correct — Webhook config write is a powerful, cluster-wide capability.

Correct — Each stolen identity opens the next door.

Correct — Zero-trust networking boxes in a compromised pod.

Correct — It records exec, secret access, RBAC changes, and more.

Correct — These map to credential access, escalation, and persistence.

Correct — Audit = control plane; runtime = what happens inside pods/nodes.

Correct — Nothing legitimate touches the decoy, so a hit is near-certain intrusion.

Correct — Invalidate the identity, then scope the blast radius.

Correct — Contain and preserve, then evict.

Correct — Attackers persist in RBAC, admission, and workloads — not just the pod.

Correct — Tune levels per resource so real events surface.

Correct — If the CA or etcd was reachable, assume trust is broken and re-establish it.

Correct — Prevent the easy paths, and detect what gets through.